Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-20989

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions.

Published

2021-04-19T14:15:11.570

Last Modified

2024-11-21T05:47:20.583

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-295
  • Type: Secondary
    CWE-295
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System fibaro home_center_2_firmware ≤ 4.600 Yes
Hardware fibaro home_center_2 - No
Operating System fibaro home_center_lite_firmware ≤ 4.600 Yes
Hardware fibaro home_center_lite - No
References