CVE-2021-20989 – Fibaro Home Center Insufficient remote access server authorization

https://notcve.org/view.php?id=CVE-2021-20989

Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older initiate SSH connections to the Fibaro cloud to provide remote access and remote support capabilities. This connection can be intercepted using DNS spoofing attack and a device initiated remote port-forward channel can be used to connect to the web management interface. Knowledge of authorization credentials to the management interface is required to perform any further actions. Los dispositivos Fibaro Home Center versión 2 y Lite con versiones de firmware 4.600 y anteriores, inician conexiones SSH a la nube de Fibaro para proporcionar acceso remoto y capacidades de soporte remoto. Esta conexión puede ser interceptada usando un ataque de suplantación de DNS y puede ser usado un canal de reenvío de puerto remoto iniciado por el dispositivo para conectarse a la interfaz de administración web. • http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html http://seclists.org/fulldisclosure/2021/Apr/27 https://www.iot-inspector.com/blog/advisory-fibaro-home-center • CWE-295: Improper Certificate Validation •