CVE-2021-20990
📋 TL;DR
Fibaro Home Center 2 and Lite devices with firmware version 4.600 and older expose an internal management service on port 8000 without authentication. Attackers can access API endpoints to trigger device shutdown, reboot, or reboot into recovery mode, causing denial of service. This affects all users of these devices with vulnerable firmware.
💻 Affected Systems
- Fibaro Home Center 2
- Fibaro Home Center Lite
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers can remotely reboot devices into recovery mode, potentially enabling further exploitation or causing permanent service disruption requiring physical intervention.
Likely Case
Remote attackers cause denial of service by triggering device reboots or shutdowns, disrupting home automation functionality.
If Mitigated
With proper network segmentation and firewall rules, impact is limited to internal network attacks only.
🎯 Exploit Status
Exploitation requires only network access to port 8000 and knowledge of API endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version newer than 4.600
Vendor Advisory: https://www.fibaro.com/en/support/
Restart Required: Yes
Instructions:
1. Log into Fibaro Home Center web interface
2. Navigate to Settings > System > Updates
3. Check for and install firmware updates
4. Reboot device after update completes
🔧 Temporary Workarounds
Block Port 8000
linuxUse firewall rules to block external access to port 8000 on affected devices
iptables -A INPUT -p tcp --dport 8000 -j DROP
Network Segmentation
allPlace Home Center devices on isolated VLAN without internet access
🧯 If You Can't Patch
- Implement strict firewall rules blocking all external access to port 8000
- Monitor network traffic for unauthorized access attempts to port 8000
🔍 How to Verify
Check if Vulnerable:
Check if port 8000 is open and accessible: nmap -p 8000 <device_ip>Check Version:
Check web interface at http://<device_ip>/api/settings/system or via SSH: cat /etc/versionVerify Fix Applied:
Verify firmware version is newer than 4.600 and port 8000 is not externally accessible📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to port 8000
- Unexpected device reboots or shutdowns
Network Indicators:
- External connections to port 8000
- HTTP requests to /api/shutdown, /api/reboot, or /api/recovery endpoints
SIEM Query:
source_port=8000 OR (http_uri CONTAINS "/api/shutdown" OR http_uri CONTAINS "/api/reboot" OR http_uri CONTAINS "/api/recovery")🔗 References
- http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html
- http://seclists.org/fulldisclosure/2021/Apr/27
- https://www.iot-inspector.com/blog/advisory-fibaro-home-center/
- http://packetstormsecurity.com/files/162243/Fibaro-Home-Center-MITM-Missing-Authentication-Code-Execution.html
- http://seclists.org/fulldisclosure/2021/Apr/27
- https://www.iot-inspector.com/blog/advisory-fibaro-home-center/
