In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| http://seclists.org/fulldisclosure/2021/Apr/27 | Mailing List Third Party Advisory |
| https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ | Exploit Third Party Advisory |
Configurations
History
23 Apr 2021, 16:08
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:fibaro:home_center_lite_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:fibaro:home_center_lite:-:*:*:*:*:*:*:* cpe:2.3:o:fibaro:home_center_2_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:fibaro:home_center_2:-:*:*:*:*:*:*:* |
|
| CWE | CWE-319 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| References | (CONFIRM) https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ - Exploit, Third Party Advisory | |
| References | (FULLDISC) http://seclists.org/fulldisclosure/2021/Apr/27 - Mailing List, Third Party Advisory | |
| References | (MISC) http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry |
20 Apr 2021, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
20 Apr 2021, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Apr 2021, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-04-19 14:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-20992
Mitre link : CVE-2021-20992
CVE.ORG link : CVE-2021-20992
JSON object : View
Products Affected
fibaro
- home_center_2
- home_center_2_firmware
- home_center_lite_firmware
- home_center_lite
CWE
CWE-319
Cleartext Transmission of Sensitive Information