CVEvulnerability

CVE-2021-20107

5.4 MEDIUM Published 2021-06-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-06-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.8 MEDIUM — AV:A/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-306

Description

There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance.

Affected configurations

• sloan optima eaf-100 firmware • sloan optima eaf-150 firmware • sloan optima eaf-200 firmware • sloan optima eaf-225 firmware • sloan optima eaf-250 firmware • sloan optima eaf-275 firmware • sloan optima eaf-350 firmware • sloan optima eaf-700 firmware • sloan optima eaf-750 firmware • sloan optima ebf-187 firmware • sloan optima ebf-415 firmware • sloan optima ebf-425 firmware • sloan optima ebf-550 firmware • sloan optima ebf-615 firmware • sloan optima ebf-650 firmware • sloan optima ebf-665 firmware • sloan optima ebf-750 firmware • sloan optima ebf-775 firmware • sloan optima ebf-85 firmware • sloan optima ebf-850 firmware • sloan optima etf-610 firmware • sloan optima etf-600 firmware • sloan optima etf-410 firmware • sloan optima etf-420 firmware • sloan optima etf-500 firmware • sloan optima etf-660 firmware • sloan optima etf-700 firmware • sloan optima etf-770 firmware • sloan optima etf-80 firmware • sloan optima etf-800 firmware • sloan optima etf-880 firmware • sloan basys efx-300 firmware • sloan basys efx-350 firmware • sloan basys efx-375 firmware • sloan basys efx-377 firmware • sloan basys efx-380 firmware • sloan basys efx-600 firmware • sloan basys efx-650 firmware • sloan basys efx-675 firmware • sloan basys efx-677 firmware • sloan basys efx-680 firmware • sloan basys efx-200 firmware • sloan basys efx-250 firmware • sloan basys efx-275 firmware • sloan basys efx-277 firmware • sloan basys efx-280 firmware • sloan basys efx-100 firmware • sloan basys efx-150 firmware • sloan basys efx-175 firmware • sloan basys efx-177 firmware • sloan basys efx-180 firmware • sloan basys efx-800 firmware • sloan basys efx-850 firmware • sloan solis 8111 firmware • sloan solis 8186 firmware • sloan solis ress-c firmware • sloan solis ress-u firmware • sloan solis 8152 firmware • sloan solis 8195 firmware • sloan solis 8115 firmware … and 11 more

Related

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References