Marton Illes

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older Description: The issue concerns Fibaro Home Center 2 and Lite devices that initiate SSH connections to the Fibaro cloud for remote access and support. This connection is vulnerable to interception via a DNS spoofing attack, allowing an attacker to use a device-initiated remote port-forward channel to connect to the web management interface. To perform further actions, knowledge of authorization credentials to the management interface is required. Recommendations: For firmware version 4.600 and older, update to a version newer than 4.600 to resolve the issue. As a temporary workaround, consider restricting access to the web management interface until a patch is available. Avoid using the device-initiated remote port-forward channel for remote access and support until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite versions 4.600 and older Description: The issue concerns an internal management service accessible on port 8000, where certain API endpoints can be accessed without authentication. This allows unauthorized actions such as triggering a shutdown, a reboot, or a reboot into recovery mode. Recommendations: For Fibaro Home Center 2 and Lite versions 4.600 and older, update to a version newer than 4.600 to resolve the issue. As a temporary workaround, consider restricting access to port 8000 to minimize the risk of exploitation. Avoid using API endpoints that can trigger shutdown, reboot, or reboot into recovery mode without proper authentication until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite versions 4.540 and older Description: The issue allows an authenticated user to run commands as the root user due to a command injection vulnerability. Recommendations: For Fibaro Home Center 2 and Lite versions 4.540 and older, update to a version newer than 4.540 to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Fibaro Home Center 2 and Lite devices (affected versions not specified) Description: The issue concerns the use of an unencrypted HTTP protocol for the web-based management interface. This allows communication between the user and the device to be eavesdropped, potentially leading to the hijacking of sessions, tokens, and passwords. Recommendations: For all versions of Fibaro Home Center 2 and Lite devices, consider disabling the web-based management interface until a secure, encrypted connection method is implemented. Restrict access to the device's management interface to minimize the risk of exploitation. As a temporary workaround, avoid using the management interface over unsecured networks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.