Remote File Inclusion in FIBARO System Home Center by FIBARO
CVE-2020-36905

5.1MEDIUM

Key Information:

Vendor: Fibar Group S.a.
Status: Home Center 3; Home Center 2; Home Center Lite
Vendor: CVE Published:; 6 January 2026

🔔 Create Fibar Group S.a. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2020-36905?

The FIBARO System Home Center 5.021 is impacted by a remote file inclusion vulnerability due to an undocumented proxy API. This issue enables attackers to exploit the 'url' GET parameter, allowing them to inject arbitrary client-side scripts. By leveraging this vulnerability, attackers can include malicious JavaScript, leading to possible session hijacking or manipulation of page content, thereby posing significant risks to user security and privacy.

Affected Version(s)

Home Center 2 0 <= 5.021.38

Home Center 3 0 <= 5.021.38

Home Center Lite 0 <= 5.021.38

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-36905 - Proof of Concept