CVE-2021-20989: Fibaro Home Center Insufficient remote access server authorization
First published: Mon Apr 19 2021(Updated: )
Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions.
Credit: info@cert.vde.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fibaro Home Center 2 Firmware | <=4.600 | |
| Fibaro Home Center 2 | ||
| Fibaro Home Center Lite Firmware | <=4.600 | |
| Fibaro Home Center Lite |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-20989?
CVE-2021-20989 refers to a vulnerability found in Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older, which can be exploited through DNS spoofing to intercept SSH connections and establish a device initiated remote port-forward channel.
How does CVE-2021-20989 affect Fibaro Home Center 2 and Lite devices?
CVE-2021-20989 affects Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older, allowing for potential interception of SSH connections and unauthorized establishment of a remote port-forward channel.
What is the severity of CVE-2021-20989?
CVE-2021-20989 has a severity rating of 5.9 (medium).
How can I fix CVE-2021-20989?
To fix CVE-2021-20989, it is recommended to update the firmware of Fibaro Home Center 2 and Lite devices to a version higher than 4.600 to address the vulnerability.
Where can I find more information about CVE-2021-20989?
You can find more information about CVE-2021-20989 in the following references: [1] http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html [2] http://seclists.org/fulldisclosure/2021/Apr/27 [3] https://www.iot-inspector.com/blog/advisory-fibaro-home-center/
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/weakness
- agent/references
- agent/author
- agent/last-modified-date
- agent/event
- agent/tags
- agent/description
- agent/first-publish-date
- vendor/fibaro
- canonical/fibaro home center 2 firmware
- version/fibaro home center 2 firmware/4.600
- canonical/fibaro home center 2
- canonical/fibaro home center lite firmware
- version/fibaro home center lite firmware/4.600
- canonical/fibaro home center lite