CVE-2021-20107 Missing authorization in SLOAN
Unauthenticated attackers can use Bluetooth Low Energy to read maintenance data and modify water flow or sensor settings on Sloan smart faucets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20107?
CVE-2021-20107 is a medium-severity missing authorization vulnerability in SLOAN, published on 30 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance.
Weakness: CWE-306
Which versions are affected by CVE-2021-20107?
It affects 71 products.
Products include Sloan Basys Efx-100 Firmware, Sloan Basys Efx-150 Firmware, Sloan Basys Efx-175 Firmware, Sloan Basys Efx-177 Firmware, Sloan Basys Efx-180 Firmware, Sloan Basys Efx-200 Firmware and 65 more.
How do I fix CVE-2021-20107?
No fix has been published for CVE-2021-20107 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-20107 being exploited?
There is no known exploitation of CVE-2021-20107 in the wild and no public exploit code.
Sources
Also known as GHSA-6fjv-rgvm-7x24.