CVE-2020-21998
CVE-2020-21998
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Functional exploit
Automatable exploit available (Nuclei/Metasploit).
CVSS —EPSS 1.3%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
27 Apr 2021Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain.
Affected products
n/a · n/a