CVE-2021-20992 - CVE House

Status published High CVE-2021-20992

Fibaro Home Center Unencrypted management interface

8.1 CVSS

Vulnerability Description

In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-20992

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Marton Illes IoT Inspector Research Lab https://www.iot-inspector.com

References

More from Fibar Group S.A

View All →

CVE-2021-20991

Fibaro Home Center Authenticated remote command execution

Critical 9.8

CVE-2021-20990

Fibaro Home Center Unauthenticated access to shutdown, reboot and reboot to recovery mode

High 7.5

CVE-2021-20989

Fibaro Home Center Insufficient remote access server authorization

Medium 5.9

Affected Vendor

Fibar Group S.A

View all reports →

Affected Software

Fibaro Home Center

Vulnerable Versions:

Home Center 2 all, Home Center Lite all

Timeline

Official Publish: April 19th, 2021

Last Modified: September 17th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-319

MITRE ATT&CK TTPs

T1040 Network Sniffing

Collection

T1557 Adversary-in-the-Middle

Credential Access

T1552 Unsecured Credentials