CVE-2021-20989

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-20998.2Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that ar CVE-2021-209907.5In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and CVE-2021-209918.8In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a c CVE-2021-209927.5In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communicat CVE-2021-209935.3In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resour CVE-2021-209946.1In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malici CVE-2021-209957.5In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.CVE-2021-209965.3In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.CVE-2021-209977.5In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.CVE-2021-209989.8In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create CVE-2021-209999.8In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally ac CVE-2021-21009.1Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Print Server). Supported versions that are