Platform
other
Component
fibaro-home-center
Fixed in
4.600.1
4.600.1
CVE-2021-20989 is a vulnerability affecting Fibaro Home Center 2 and Lite devices running firmware versions up to 4.600. The vulnerability allows an attacker to intercept SSH connections initiated by the device to the Fibaro cloud through a DNS spoofing attack. This can lead to unauthorized access to the device's web management interface, potentially compromising sensitive data and control of the home automation system.
The primary impact of CVE-2021-20989 lies in the potential for unauthorized remote access to the Fibaro Home Center. An attacker successfully spoofing the DNS resolution can establish a connection to the device and, if they possess valid credentials for the web management interface, gain full control. This control could be used to modify device settings, access sensitive data stored on the device (such as user credentials or home automation rules), or even use the device as a pivot point to attack other devices on the network. The attack leverages the device's built-in remote access and support features, making it particularly insidious as it exploits a legitimate functionality for malicious purposes. Successful exploitation could lead to a complete compromise of the home network.
CVE-2021-20989 was publicly disclosed on April 19, 2021. There is no indication of active exploitation campaigns or inclusion in the CISA KEV catalog at this time. Public proof-of-concept exploits are not widely available, but the vulnerability's nature makes it potentially attractive to threat actors with the technical expertise to perform DNS spoofing attacks.
Exploit Status
EPSS
1.84% (83% percentile)
CVSS Vector
The primary mitigation for CVE-2021-20989 is to upgrade the Fibaro Home Center firmware to a version that addresses the vulnerability. Fibaro has not released a specific fixed version in the provided data, so users should monitor the Fibaro website for updates. As a temporary workaround, consider disabling remote access features on the Home Center if they are not essential. Implementing DNSSEC (DNS Security Extensions) on your network can help prevent DNS spoofing attacks, although this requires configuration changes at your DNS provider. Regularly review the Home Center's access logs for any suspicious activity.
Update the firmware of Fibaro Home Center 2 and Lite devices to a version later than 4.600. This corrects the SSH connection interception vulnerability and potential unauthorized access to the web management interface.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2021-20989 is a vulnerability in Fibaro Home Center ≤4.600 that allows attackers to intercept SSH connections via DNS spoofing, potentially gaining access to the device's management interface.
You are affected if you are using Fibaro Home Center 2 or Lite with firmware version 4.600 or earlier. Check your device's firmware version and upgrade if possible.
Upgrade your Fibaro Home Center firmware to a patched version. Monitor the Fibaro website for updates. As a temporary measure, disable remote access features if not essential.
There is no confirmed evidence of active exploitation at this time, but the vulnerability's nature makes it a potential target.
Refer to the Fibaro security advisory page for the latest information and updates regarding CVE-2021-20989: [https://www.fibaro.com/security-advisories/](https://www.fibaro.com/security-advisories/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.