CVE-2021-20989: fibaro home center 2 firmware +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-20989

CVSS 5.9 · Medium EPSS 2,0%

Kerentanan Improper Certificate Validation pada fibaro home center 2 firmware, fibaro home center lite firmware. Skor CVSS 3.1 5.9 (Medium) menurut cert.vde.com.

Deskripsi (NVD)

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions.

Rincian

Terbit di NVD: 19 April 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.9 (Medium), sumber cert.vde.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-295: Improper Certificate Validation
EPSS (30 hari): 2,0% peluang dieksploitasi; lebih tinggi dari 80,0% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
fibaro	home center 2 firmware	Semua versi hingga 4.600
fibaro	home center lite firmware	Semua versi hingga 4.600

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
http://seclists.org/fulldisclosure/2021/Apr/27 mailing list · advisory pihak ketiga
https://www.iot-inspector.com/blog/advisory-fibaro-home-center/ exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.