Vulnerability · Published Apr 19, 2021 · Assigned by CERTVDE
CVE-2021-20992Fibaro Home Center Unencrypted management interface
High 8.1
In plain English
A high-severity security flaw in Fibaro Home Center from Fibar Group S.A. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.4%top 27.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fibar Group S.A | Fibaro Home Center | Home Center 2 allHome Center Lite all |
Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ x_refsource_CONFIRM
- 20210419 [CVE-2021-20989, CVE-2021-20990, CVE-2021-20991, CVE-2021-20992] Multiple vulnerabilities in Fibaro Home Center mailing-list, x_refsource_FULLDISC
- http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html x_refsource_MISC