CVE-2021-20992 Fibaro Home Center Unencrypted management interface
Attackers can eavesdrop on unencrypted HTTP traffic to steal session tokens and passwords from Fibaro Home Center devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20992?
CVE-2021-20992 is a high-severity vulnerability in Fibaro Home Center, published on 19 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords.
Weakness: CWE-319
Which versions are affected by CVE-2021-20992?
It affects 2 products.
Products include Fibaro Home Center 2 Firmware, Fibaro Home Center Lite Firmware.
How do I fix CVE-2021-20992?
No fix has been published for CVE-2021-20992 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-20992 being exploited?
There is no known exploitation of CVE-2021-20992 in the wild and no public exploit code.
Other vulnerabilities in Fibaro Home Center
Sources
Also known as GHSA-pmqf-hcfv-43rc.