FIBARO System Home Center 5.021 Remote File Inclusion via Proxy API
Priority MEDIUM 62CWE-829Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-829.
Summary
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00522 44th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fibar Group S.A | Home Center 3 | up to 5.021.38 | — | No fix listed | CNA |
| Fibar Group S.A | Home Center 2 | up to 5.021.38 | — | No fix listed | CNA |
| Fibar Group S.A | Home Center Lite | up to 5.021.38 | — | No fix listed | CNA |
- Home Center 3 VendorFibar Group S.A Affected up to 5.021.38 Fixed in — No fix listed CNA
- Home Center 2 VendorFibar Group S.A Affected up to 5.021.38 Fixed in — No fix listed CNA
- Home Center Lite VendorFibar Group S.A Affected up to 5.021.38 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36905
- 2026-10-03 Alias added: GHSA-433h-wv4r-9p9x
References
More Fibar Group S.A vulnerabilities
- TI-2021-04097 Fibaro Home Center Authenticated remote command execution CVSS 3.1CRITICAL 9.8
- TI-2021-04096 Fibaro Home Center Unauthenticated access to shutdown, reboot and reboot to recovery mode CVSS 3.1HIGH 7.5
- TI-2021-04098 Fibaro Home Center Unencrypted management interface CVSS 3.1HIGH 8.1
- TI-2023-17330 A vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial… CVSS 3.1MEDIUM 6.5
- TI-2021-04095 Fibaro Home Center Insufficient remote access server authorization CVSS 3.1MEDIUM 5.9
- TI-2020-07273 Origin validation error in ZooZ ZEN25 CVSS 3.1MEDIUM 6.5
Sources
- CVE-2020-36905 · CVE Program
- CVE-2020-36905 · NVD
- FIRST EPSS
- GHSA-433h-wv4r-9p9x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences