CVE-2021-27952

Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader environment through the serial console...

CVE-2021-27954

A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to force the device to connect to a SSID or cause a denial of service...

CVE-2021-27952

Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader environment through the serial console...

CVE-2021-27954

A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to force the device to connect to a SSID or cause a denial of service...

Hardcoded credentials

Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader environment through the serial console...

CVE-2021-27953

A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forcing the device to reboot via a crafted HTTP request...

Heap overflow

A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to force the device to connect to a SSID or cause a denial of service...

Null pointer dereference

A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forcing the device to reboot via a crafted HTTP request...

CVE-2021-27953

CVE-2021-27953 describes a NULL pointer dereference in Ecobee3 Lite (firmware 4.5.81.200) during the HomeKit Wireless Access Control setup. A threat actor can cause a denial of service by sending a crafted HTTP request, forcing reboot. Documents confirm the affected device and the underlying caus...

CVE-2021-27953

A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forcing the device to reboot via a crafted HTTP request...

CVE-2021-27952

CVE-2021-27952 affects Ecobee3 Lite with firmware 4.5.81.200, where hardcoded default root credentials grant access to the password-protected bootloader environment via the serial console. Public references from NVD list a CVSS v3.1 base score of 9.8 (CRITICAL) with network access and no privileg...

CVE-2021-27954

CVE-2021-27954 affects ecobee3 lite devices (version 4.5.81.200) with a heap-based buffer overflow in HKProcessConfig of the HomeKit Wireless Access Control setup. The underlying cause is improper data boundary validation in HKProcessConfig, enabling an attacker to force the device to connect to ...

PT-2021-17692

Name of the Vulnerable Software and Affected Versions: ecobee3 lite version 4.5.81.200 Description: A NULL pointer dereference issue exists in the HomeKit Wireless Access Control setup process, allowing a threat actor to cause a denial of service by forcing the device to reboot via a crafted HTTP...

PT-2021-17691

Name of the Vulnerable Software and Affected Versions: ecobee3 lite version 4.5.81.200 Description: The issue concerns hardcoded default root credentials on the device. This allows a threat actor to gain access to the password-protected bootloader environment through the serial console...

PT-2021-17693 · Ecobee · Ecobee3 Lite

Name of the Vulnerable Software and Affected Versions: ecobee3 lite version 4.5.81.200 Description: A heap-based buffer overflow vulnerability exists in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. An attacker can exploit this vulnerability to force the devic...

CVE-2021-27952: Use of Hard-coded Credentials

Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader environment through the serial console...

CVE-2021-27954: Out-of-bounds Write

A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to force the device to connect to a SSID or cause a denial of service...

CVE-2021-27953: NULL Pointer Dereference

A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forcing the device to reboot via a crafted HTTP request...

Ecobee Ecobee3 Lite code issue and vulnerability

Ecobee Ecobee3 Lite is a Wi-Fi smart thermostat from Ecobee Canada.A security vulnerability exists in Ecobee Ecobee3 Lite, which stems from a reference to a freed pointer condition in the product's WIFI access settings. An attacker could cause a denial of service to the target via an ad hoc HTTP...

Ecobee Ecobee3 Lite Buffer Error Vulnerability

Ecobee Ecobee3 Lite is a Wi-Fi smart thermostat from Ecobee Canada.A buffer error vulnerability exists in Ecobee Ecobee3 Lite, which stems from HKProcessConfig in the product's HomeKit wireless access control settings failing to properly validate data boundaries, which could be used by an attacke...