FIBARO System Home Center 5.021 Remote File Inclusion via Proxy API

Advisories

severity: medium
date: January 5, 2026
Affecting: Home Center 3, Home Center 2, Home Center Lite
<= 5.021.38
CVE: CVE-2020-36905
CWE: CWE-829 Inclusion of Functionality from Untrusted Control Sphere
CVSS: 5.1
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References: ExploitDB-48240
Official Vendor Homepage
Zero Science Lab Disclosure (ZSL-2020-5563)
Packet Storm Security Exploit Entry
CXSecurity Vulnerability Listing
IBM X-Force Vulnerability Exchange
Credit: LiquidWorm as Gjoko Krstic of Zero Science Lab
Description: FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions or manipulate page content.