CVE-2021-20990: In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints…

PriorityP346high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

3.43%

87.4th percentile

In Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older an internal management service is accessible on port 8000 and some API endpoints could be accessed without authentication to trigger a shutdown, a reboot or a reboot into recovery mode.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
fibar_group_s.a	fibaro_home_center	Home Center 2 – 4.600	—
fibar_group_s.a	fibaro_home_center	Home Center Lite – 4.600	—
fibaro	home_center_2_firmware	<= 4.600	—
fibaro	home_center_lite_firmware	<= 4.600	—

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.