by Kastro
Paper/Archive/CVE-2021-20991

CVE-2021-20991

Fibar Group S.A Fibaro Home Center — Fibaro Home Center Authenticated remote command execution

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.7.927 × 2018.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability.

Affected

ProductAffectedFixed inSource
Fibaro Home CenterHome Center 2 – 4.540–CNA
Fibaro Home CenterHome Center Lite – 4.540–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refiot-inspector.com/blog/advisory-fibaro-home-centerrefseclists.org/fulldisclosure/2021/Apr/27refpacketstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html