Vulnerability Description
A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to force the device to connect to a SSID or cause a denial of service.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ecobee | Ecobee3 Lite Firmware | 4.5.81.200 |
| Ecobee | Ecobee3 Lite | - |
Related Weaknesses (CWE)
References
- https://www.l9group.com/advisories/ecobee3-lite-heap-overflowExploitThird Party Advisory
- https://www.l9group.com/advisories/ecobee3-lite-heap-overflowExploitThird Party Advisory
FAQ
What is CVE-2021-27954?
CVE-2021-27954 is a vulnerability with a CVSS score of 8.2 (HIGH). A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit...
How severe is CVE-2021-27954?
CVE-2021-27954 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-27954?
Check the references section above for vendor advisories and patch information. Affected products include: Ecobee Ecobee3 Lite Firmware, Ecobee Ecobee3 Lite.