PT-2021-13777 · Sloan · Solis+4

Published 2021-06-30 · Updated 2021-07-08 · CVE-2021-20107

Positive Technologies (AI Summary)

CVSS v2.0

4.8

Medium

Base vector

AV:A/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS (affected versions not specified)

Description: The issue concerns an unauthenticated BLE Interface in Sloan SmartFaucets. This allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device, controlling aspects such as the flow of water, sensor sensitivity, and maintenance information.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-20107

Affected Products

Basys Efx

Optima Eaf

Optima Etf/Ebf

Solis

Sloan Smartfaucets

References · 3

• 🔥 https://tenable.com/security/research/tra-2021-26-0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20107 · Security Note
• https://t.me/cvenotify/17250 · Telegram Post