Cyber Resilience

CVE-2020-36905

MediumPublic PoC

Published: 06 January 2026

Published
06 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0006 19.2th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2020-36905 is a medium-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2020-36905 is a remote file inclusion vulnerability (CWE-829) affecting the FIBARO System Home Center version 5.021, specifically in its undocumented proxy API. The flaw allows attackers to include arbitrary client-side scripts by exploiting the 'url' GET parameter, enabling the injection of malicious JavaScript. This issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low attack complexity, and no requirements for privileges or user interaction.

Remote attackers without authentication can exploit this vulnerability over the network by crafting requests to the proxy API with a malicious 'url' parameter pointing to attacker-controlled JavaScript. Successful exploitation allows injection of scripts into the victim's browser, potentially leading to session hijacking, theft of sensitive user data, or manipulation of page content viewed by legitimate users of the Home Center.

Advisories and related resources, including exploit details, are available at sites such as https://cxsecurity.com/issue/WLB-2020030140, https://exchange.xforce.ibmcloud.com/vulnerabilities/178269, https://packetstorm.news/files/id/156869, https://www.exploit-db.com/exploits/48240, and the vendor site https://www.fibaro.com. These references document the vulnerability and proof-of-concept exploits but do not specify mitigation steps or patches in the provided details.

EU & UK References

Vulnerability details

FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions…

more

or manipulate page content.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote unauthenticated file inclusion in public-facing proxy API directly enables exploitation of public-facing applications for JS injection.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-70046Shared CWE-829
CVE-2025-70974Shared CWE-829
CVE-2025-27668Shared CWE-829
CVE-2025-68924Shared CWE-829
CVE-2026-28135Shared CWE-829
CVE-2025-62726Shared CWE-829
CVE-2026-43571Shared CWE-829
CVE-2026-8426Shared CWE-829
CVE-2024-32011Shared CWE-829
CVE-2025-11023Shared CWE-829

Affected Assets

Cxsecurity
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates the vulnerability by requiring validation of the exploitable 'url' GET parameter to block arbitrary external JavaScript inclusion via the proxy API.

prevent

Ensures timely patching or remediation of the specific RFI flaw in FIBARO Home Center 5.021, eliminating the proxy API vulnerability.

preventdetect

Boundary protection via WAF or similar enforces filtering of malicious RFI requests targeting the undocumented proxy API before they reach the application.

References