CVE-2021-20990

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Apr 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-209918.8In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a c CVE-2021-209927.5In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communicat CVE-2021-209935.3In multiple managed switches by WAGO in different versions the activated directory listing provides an attacker with the index of the resour CVE-2021-209946.1In multiple managed switches by WAGO in different versions an attacker may trick a legitimate user to click a link to inject possible malici CVE-2021-209957.5In multiple managed switches by WAGO in different versions the webserver cookies of the web based UI contain user credentials.CVE-2021-209965.3In multiple managed switches by WAGO in different versions special crafted requests can lead to cookies being transferred to third parties.CVE-2021-209977.5In multiple managed switches by WAGO in different versions it is possible to read out the password hashes of all Web-based Management users.CVE-2021-209989.8In multiple managed switches by WAGO in different versions without authorization and with specially crafted packets it is possible to create CVE-2021-209999.8In Weidmüller u-controls and IoT-Gateways in versions up to 1.12.1 a network port intended only for device-internal usage is accidentally ac CVE-2021-21009.1Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Print Server). Supported versions that are CVE-2021-210007.5On WAGO PFC200 devices in different firmware versions with special crafted packets an attacker with network access to the device could cause CVE-2021-210016.5On WAGO PFC200 devices in different firmware versions with special crafted packets an authorised attacker with network access to the device