Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

MAL-2026-14475 Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

MAL-2026-14474 Malicious code in ecobee-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...

Malicious code in ecobee-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...

Ecobee Ecobee3 Lite Hardcoded Default Root Credentials Vulnerability

Ecobee Ecobee3 Lite is a Wi-Fi smart thermostat from Ecobee Canada.Ecobee Ecobee3 Lite contains a security vulnerability that could be exploited by an attacker to access the password-protected bootloader environment via the serial console...

Ecobee Ecobee3 Lite Buffer Overflow Vulnerability

Ecobee Ecobee3 Lite is a Wi-Fi smart thermostat from Ecobee Canada.A buffer error vulnerability exists in Ecobee Ecobee3 Lite, which stems from HKProcessConfig in the product's HomeKit wireless access control settings failing to properly validate data boundaries, which could be used by an attacke...

CVE-2021-27953

A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forcing the device to reboot via a crafted HTTP request...

Ecobee Ecobee3 Lite 代码问题漏洞

Ecobee Ecobee3 Lite is a Wi-Fi smart thermostat from Ecobee Canada.A security vulnerability exists in Ecobee Ecobee3 Lite, which stems from a reference to a freed pointer condition in the product's WIFI access settings. An attacker could cause a denial of service to the target via an ad hoc HTTP...

Ecobee Ecobee3 Lite 信任管理问题漏洞

Ecobee Ecobee3 Lite is a Wi-Fi smart thermostat from Ecobee Canada.Ecobee Ecobee3 Lite contains a security vulnerability that could be exploited by an attacker to access the password-protected bootloader environment via the serial console...

Ecobee Ecobee4 Input Validation Error Vulnerability

The Ecobee Ecobee4 is a room smart thermostat from Ecobee Canada. An input validation error vulnerability exists in Ecobee Ecobee4 version 4.2.0.171. The vulnerability originates from a network system or product that does not properly validate input data. No details of the vulnerability are...

CVE-2018-6402

Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal. An attacker must be able to set up a nearby...

ecobee: CSTI on https://www.ecobee.com leads to XSS

Summary: Hi EcoBee team, the https://www.ecobee.com domain is vulnerable against angular injection via CSTI, that leads to XSS. Steps To Reproduce: 1. Go on https://www.ecobee.com/?s=x%20=%20%27y%27:%27%27.constructor.prototype;%20x%27y%27.charAt=.join;$eval%27x=alert/Mik/%27; 1. XSS executed...