CVE-2020-36905
Published: 06 January 2026
Summary
CVE-2020-36905 is a medium-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-36905 is a remote file inclusion vulnerability (CWE-829) affecting the FIBARO System Home Center version 5.021, specifically in its undocumented proxy API. The flaw allows attackers to include arbitrary client-side scripts by exploiting the 'url' GET parameter, enabling the injection of malicious JavaScript. This issue has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low attack complexity, and no requirements for privileges or user interaction.
Remote attackers without authentication can exploit this vulnerability over the network by crafting requests to the proxy API with a malicious 'url' parameter pointing to attacker-controlled JavaScript. Successful exploitation allows injection of scripts into the victim's browser, potentially leading to session hijacking, theft of sensitive user data, or manipulation of page content viewed by legitimate users of the Home Center.
Advisories and related resources, including exploit details, are available at sites such as https://cxsecurity.com/issue/WLB-2020030140, https://exchange.xforce.ibmcloud.com/vulnerabilities/178269, https://packetstorm.news/files/id/156869, https://www.exploit-db.com/exploits/48240, and the vendor site https://www.fibaro.com. These references document the vulnerability and proof-of-concept exploits but do not specify mitigation steps or patches in the provided details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1031
Vulnerability details
FIBARO System Home Center 5.021 contains a remote file inclusion vulnerability in the undocumented proxy API that allows attackers to include arbitrary client-side scripts. Attackers can exploit the 'url' GET parameter to inject malicious JavaScript and potentially hijack user sessions…
more
or manipulate page content.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated file inclusion in public-facing proxy API directly enables exploitation of public-facing applications for JS injection.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the vulnerability by requiring validation of the exploitable 'url' GET parameter to block arbitrary external JavaScript inclusion via the proxy API.
Ensures timely patching or remediation of the specific RFI flaw in FIBARO Home Center 5.021, eliminating the proxy API vulnerability.
Boundary protection via WAF or similar enforces filtering of malicious RFI requests targeting the undocumented proxy API before they reach the application.