PT-2021-14320

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite versions 4.540 and older Description: The issue allows an authenticated user to run commands as the root user due to a command injection vulnerability. Recommendations: For Fibaro Home Center 2 and Lite versions...

PT-2021-14318 · Fibaro · Fibaro Home Center Lite +1

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older Description: The issue concerns Fibaro Home Center 2 and Lite devices that initiate SSH connections to the Fibaro cloud for remote access and support. This connection...

FIBARO Home Center 2 命令注入漏洞

FIBARO Home Center 2 is an application system of the Polish company FIBARO. A system integration system. Fibaro Home Center 2 suffers from a command injection vulnerability that originates in Lite devices with firmware version 4.540 and above, which can be exploited by an authenticated user to ru...

Fibaro Home Center 2 安全漏洞

FIBARO Home Center 2 is an application system of the Polish company FIBARO. A system integration system. A security vulnerability exists in Fibaro Home Center 2 that stems from the fact that communications between users and devices can be eavesdropped on to hijack sessions, tokens, and passwords...

PT-2021-14321

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite devices affected versions not specified Description: The issue concerns the use of an unencrypted HTTP protocol for the web-based management interface. This allows communication between the user and the device to...

FIBARO Home Center 2 信任管理问题漏洞

FIBARO Home Center 2 is an application system of the Polish company FIBARO. A system integration system. A security vulnerability exists in Fibaro Home Center 2 that originates from an SSH connection that can be intercepted by a DNS spoofing attack...

CVE-2021-20991: Improper Neutralization of Special Elements used in an OS Command

In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability...

CVE-2021-20990: Missing Authentication for Critical Function

In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode...

CVE-2021-20992: Cleartext Transmission of Sensitive Information

In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords...

PT-2021-14319 · Fibaro · Fibaro Home Center Lite +1

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite versions 4.600 and older Description: The issue concerns an internal management service accessible on port 8000, where certain API endpoints can be accessed without authentication. This allows unauthorized action...

CVE-2021-20989: Improper Certificate Validation

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be...

CVE-2021-20991

In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability...

CVE-2021-20990

In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode...

CVE-2021-20989

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be...

CVE-2021-20992

In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords...

Connected Home Hubs Open Houses to Full Remote Takeover

Three different connected home hubs – Fibaro Home Center Lite, Homematic Central Control Unit CCU2 and Elko’s eLAN-RF-003 – are vulnerable in their older versions to serious bugs that would allow information disclosure, man-in-the-middle MiTM attacks and unauthenticated remote code execution RCE,...

FIBARO System Home Center 5.021 - Remote File Include

FIBARO System Home Center 5.021 - Remote File Include Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Date: 2020-03-22 Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3,...

FIBARO System Home Center 5.021 - Remote File Include Vulnerability

Exploit for multiple platform in category web applications Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3, Home Center...

FIBARO System Home Center 5.021 Remote File Inclusion / XSS

FIBARO System Home Center v5.021 Remote File Include XSS Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3, Home Center 2, Home Center Lite 5.021.38 4.580 4.570 4.540 4.530 4.510 4.180 Summary: Imagine that you live in a house where everything happe...

FIBARO System Home Center 5.021 - Remote File Include

Exploit Title: FIBARO System Home Center 5.021 - Remote File Include Date: 2020-03-22 Author: LiquidWorm Vendor: https://www.fibaro.com CVE: N/A Vendor: FIBAR GROUP S.A. Product web page: https://www.fibaro.com Affected version: Home Center 3, Home Center 2, Home Center Lite 5.021.38 4.580 4.570...