CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-34597
https://notcve.org/view.php?id=CVE-2023-34597
A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of Service (DoS) via a crafted Z-Wave message. • https://github.com/iot-sec23/IoT-CVE/blob/main/Fibaro%20Motion%20Sensor%20Vulnerability%20Report.pdf https://www.fibaro.com/en/products/motion-sensor/%3B •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-9060
https://notcve.org/view.php?id=CVE-2020-9060
Z-Wave devices based on Silicon Labs 500 series chipsets using S2, including but likely not limited to the ZooZ ZST10 version 6.04, ZooZ ZEN20 version 5.03, ZooZ ZEN25 version 5.03, Aeon Labs ZW090-A version 3.95, and Fibaro FGWPB-111 version 4.3, are susceptible to denial of service and resource exhaustion via malformed SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, or NIF REQUEST messages. Los dispositivos Z-Wave basados en los conjuntos de chips de la serie 500 de Silicon Labs que usan S2, incluidos, entre otros, ZooZ ZST10 versión 6.04, ZooZ ZEN20 versión 5.03, ZooZ ZEN25 versión 5.03, Aeon Labs ZW090-A versión 3. 95, y Fibaro FGWPB-111 versión 4.3, son susceptibles a una denegación de servicio y al agotamiento de recursos por medio de mensajes malformados SECURITY NONCE GET, SECURITY NONCE GET 2, NO OPERATION, o NIF REQUEST • https://doi.org/10.1109/ACCESS.2021.3138768 https://github.com/CNK2100/VFuzz-public https://ieeexplore.ieee.org/document/9663293 https://kb.cert.org/vuls/id/142629 https://www.kb.cert.org/vuls/id/142629 • CWE-346: Origin Validation Error CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 4%CPEs: 4EXPL: 2CVE-2021-20992 – Fibaro Home Center Unencrypted management interface
https://notcve.org/view.php?id=CVE-2021-20992
In Fibaro Home Center 2 and Lite devices in all versions provide a web based management interface over unencrypted HTTP protocol. Communication between the user and the device can be eavesdropped to hijack sessions, tokens and passwords. En dispositivos Fibaro Home Center versión 2 y Lite en todas las versiones proporcionan una interfaz de administración basada en web sobre el protocolo HTTP sin cifrar. Una comunicación entre el usuario y el dispositivo puede ser escuchado a escondidas para secuestrar sesiones, tokens y contraseñas Fibaro Home Center Light and Fibaro Home Center 2 versions 4.600 and below suffer from man-in-the-middle, missing authentication, remote command execution, and missing encryption vulnerabilities. • http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html http://seclists.org/fulldisclosure/2021/Apr/27 https://www.iot-inspector.com/blog/advisory-fibaro-home-center • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 9.8EPSS: 3%CPEs: 4EXPL: 2CVE-2021-20991 – Fibaro Home Center Authenticated remote command execution
https://notcve.org/view.php?id=CVE-2021-20991
In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability. En dispositivos Fibaro Home Center versión 2 y Lite con versiones de firmware 4.540 y anteriores, un usuario autenticado puede ejecutar comandos como usuario root usando una vulnerabilidad de inyección de comandos Fibaro Home Center Light and Fibaro Home Center 2 versions 4.600 and below suffer from man-in-the-middle, missing authentication, remote command execution, and missing encryption vulnerabilities. • http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html http://seclists.org/fulldisclosure/2021/Apr/27 https://www.iot-inspector.com/blog/advisory-fibaro-home-center • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 3%CPEs: 4EXPL: 2CVE-2021-20990 – Fibaro Home Center Unauthenticated access to shutdown, reboot and reboot to recovery mode
https://notcve.org/view.php?id=CVE-2021-20990
In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode. En los dispositivos Fibaro Home Center versión 2 y Lite con versiones de firmware 4.600 y anteriores, un servicio de administración interno es accesible en el puerto 8000 y algunos endpoints de la API pueden ser accedidos sin autenticación para desencadenar un apagado, un reinicio o un reinicio en modo de recuperación Fibaro Home Center Light and Fibaro Home Center 2 versions 4.600 and below suffer from man-in-the-middle, missing authentication, remote command execution, and missing encryption vulnerabilities. • http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html http://seclists.org/fulldisclosure/2021/Apr/27 https://www.iot-inspector.com/blog/advisory-fibaro-home-center • CWE-306: Missing Authentication for Critical Function •