CVE-2021-20107

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance.

References

https://www.tenable.com/security/research/tra-2021-26-0

Details

Source: MITRE

Published: 2021-06-30

Updated: 2021-07-08

Type: CWE-287

Risk Information

CVSS v2

Base Score: 4.8

Vector: AV:A/AC:L/Au:N/C:P/I:P/A:N

Impact Score: 4.9

Exploitability Score: 6.5

Severity: MEDIUM

CVSS v3

Base Score: 5.4

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Impact Score: 2.5

Exploitability Score: 2.8

Severity: MEDIUM

Vulnerable Software

Configuration 1

AND

OR

cpe:2.3:o:sloan:optima_eaf-100_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-100:-:*:*:*:*:*:*:*

Configuration 2

AND

OR

cpe:2.3:o:sloan:optima_eaf-150_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-150:-:*:*:*:*:*:*:*

Configuration 3

AND

OR

cpe:2.3:o:sloan:optima_eaf-200_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-200:-:*:*:*:*:*:*:*

Configuration 4

AND

OR

cpe:2.3:o:sloan:optima_eaf-225_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-225:-:*:*:*:*:*:*:*

Configuration 5

AND

OR

cpe:2.3:o:sloan:optima_eaf-250_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-250:-:*:*:*:*:*:*:*

Configuration 6

AND

OR

cpe:2.3:o:sloan:optima_eaf-275_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-275:-:*:*:*:*:*:*:*

Configuration 7

AND

OR

cpe:2.3:o:sloan:optima_eaf-350_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-350:-:*:*:*:*:*:*:*

Configuration 8

AND

OR

cpe:2.3:o:sloan:optima_eaf-700_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-700:-:*:*:*:*:*:*:*

Configuration 9

AND

OR

cpe:2.3:o:sloan:optima_eaf-750_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_eaf-750:-:*:*:*:*:*:*:*

Configuration 10

AND

OR

cpe:2.3:o:sloan:optima_ebf-187_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-187:-:*:*:*:*:*:*:*

Configuration 11

AND

OR

cpe:2.3:o:sloan:optima_ebf-415_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-415:-:*:*:*:*:*:*:*

Configuration 12

AND

OR

cpe:2.3:o:sloan:optima_ebf-425_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-425:-:*:*:*:*:*:*:*

Configuration 13

AND

OR

cpe:2.3:o:sloan:optima_ebf-550_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-550:-:*:*:*:*:*:*:*

Configuration 14

AND

OR

cpe:2.3:o:sloan:optima_ebf-615_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-615:-:*:*:*:*:*:*:*

Configuration 15

AND

OR

cpe:2.3:o:sloan:optima_ebf-650_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-650:-:*:*:*:*:*:*:*

Configuration 16

AND

OR

cpe:2.3:o:sloan:optima_ebf-665_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-665:-:*:*:*:*:*:*:*

Configuration 17

AND

OR

cpe:2.3:o:sloan:optima_ebf-750_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-750:-:*:*:*:*:*:*:*

Configuration 18

AND

OR

cpe:2.3:o:sloan:optima_ebf-775_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-775:-:*:*:*:*:*:*:*

Configuration 19

AND

OR

cpe:2.3:o:sloan:optima_ebf-85_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-85:-:*:*:*:*:*:*:*

Configuration 20

AND

OR

cpe:2.3:o:sloan:optima_ebf-850_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_ebf-850:-:*:*:*:*:*:*:*

Configuration 21

AND

OR

cpe:2.3:o:sloan:optima_etf-610_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-610:-:*:*:*:*:*:*:*

Configuration 22

AND

OR

cpe:2.3:o:sloan:optima_etf-600_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-600:-:*:*:*:*:*:*:*

Configuration 23

AND

OR

cpe:2.3:o:sloan:optima_etf-410_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-410:-:*:*:*:*:*:*:*

Configuration 24

AND

OR

cpe:2.3:o:sloan:optima_etf-420_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-420:-:*:*:*:*:*:*:*

Configuration 25

AND

OR

cpe:2.3:o:sloan:optima_etf-500_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-500:-:*:*:*:*:*:*:*

Configuration 26

AND

OR

cpe:2.3:o:sloan:optima_etf-660_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-660:-:*:*:*:*:*:*:*

Configuration 27

AND

OR

cpe:2.3:o:sloan:optima_etf-700_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-700:-:*:*:*:*:*:*:*

Configuration 28

AND

OR

cpe:2.3:o:sloan:optima_etf-770_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-770:-:*:*:*:*:*:*:*

Configuration 29

AND

OR

cpe:2.3:o:sloan:optima_etf-80_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-80:-:*:*:*:*:*:*:*

Configuration 30

AND

OR

cpe:2.3:o:sloan:optima_etf-800_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-800:-:*:*:*:*:*:*:*

Configuration 31

AND

OR

cpe:2.3:o:sloan:optima_etf-880_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:optima_etf-880:-:*:*:*:*:*:*:*

Configuration 32

AND

OR

cpe:2.3:o:sloan:basys_efx-300_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-300:-:*:*:*:*:*:*:*

Configuration 33

AND

OR

cpe:2.3:o:sloan:basys_efx-350_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-350:-:*:*:*:*:*:*:*

Configuration 34

AND

OR

cpe:2.3:o:sloan:basys_efx-375_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-375:-:*:*:*:*:*:*:*

Configuration 35

AND

OR

cpe:2.3:o:sloan:basys_efx-377_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-377:-:*:*:*:*:*:*:*

Configuration 36

AND

OR

cpe:2.3:o:sloan:basys_efx-380_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-380:-:*:*:*:*:*:*:*

Configuration 37

AND

OR

cpe:2.3:o:sloan:basys_efx-600_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-600:-:*:*:*:*:*:*:*

Configuration 38

AND

OR

cpe:2.3:o:sloan:basys_efx-650_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-650:-:*:*:*:*:*:*:*

Configuration 39

AND

OR

cpe:2.3:o:sloan:basys_efx-675_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-675:-:*:*:*:*:*:*:*

Configuration 40

AND

OR

cpe:2.3:o:sloan:basys_efx-677_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-677:-:*:*:*:*:*:*:*

Configuration 41

AND

OR

cpe:2.3:o:sloan:basys_efx-680_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-680:-:*:*:*:*:*:*:*

Configuration 42

AND

OR

cpe:2.3:o:sloan:basys_efx-200_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-200:-:*:*:*:*:*:*:*

Configuration 43

AND

OR

cpe:2.3:o:sloan:basys_efx-250_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-250:-:*:*:*:*:*:*:*

Configuration 44

AND

OR

cpe:2.3:o:sloan:basys_efx-275_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-275:-:*:*:*:*:*:*:*

Configuration 45

AND

OR

cpe:2.3:o:sloan:basys_efx-277_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-277:-:*:*:*:*:*:*:*

Configuration 46

AND

OR

cpe:2.3:o:sloan:basys_efx-280_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-280:-:*:*:*:*:*:*:*

Configuration 47

AND

OR

cpe:2.3:o:sloan:basys_efx-100_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-100:-:*:*:*:*:*:*:*

Configuration 48

AND

OR

cpe:2.3:o:sloan:basys_efx-150_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-150:-:*:*:*:*:*:*:*

Configuration 49

AND

OR

cpe:2.3:o:sloan:basys_efx-175_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-175:-:*:*:*:*:*:*:*

Configuration 50

AND

OR

cpe:2.3:o:sloan:basys_efx-177_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-177:-:*:*:*:*:*:*:*

Configuration 51

AND

OR

cpe:2.3:o:sloan:basys_efx-180_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-180:-:*:*:*:*:*:*:*

Configuration 52

AND

OR

cpe:2.3:o:sloan:basys_efx-800_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-800:-:*:*:*:*:*:*:*

Configuration 53

AND

OR

cpe:2.3:o:sloan:basys_efx-850_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:basys_efx-850:-:*:*:*:*:*:*:*

Configuration 54

AND

OR

cpe:2.3:o:sloan:solis_8111_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8111:-:*:*:*:*:*:*:*

Configuration 55

AND

OR

cpe:2.3:o:sloan:solis_8186_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8186:-:*:*:*:*:*:*:*

Configuration 56

AND

OR

cpe:2.3:o:sloan:solis_ress-c_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_ress-c:-:*:*:*:*:*:*:*

Configuration 57

AND

OR

cpe:2.3:o:sloan:solis_ress-u_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_ress-u:-:*:*:*:*:*:*:*

Configuration 58

AND

OR

cpe:2.3:o:sloan:solis_8152_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8152:-:*:*:*:*:*:*:*

Configuration 59

AND

OR

cpe:2.3:o:sloan:solis_8195_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8195:-:*:*:*:*:*:*:*

Configuration 60

AND

OR

cpe:2.3:o:sloan:solis_8115_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8115:-:*:*:*:*:*:*:*

Configuration 61

AND

OR

cpe:2.3:o:sloan:solis_8110_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8110:-:*:*:*:*:*:*:*

Configuration 62

AND

OR

cpe:2.3:o:sloan:solis_8180_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8180:-:*:*:*:*:*:*:*

Configuration 63

AND

OR

cpe:2.3:o:sloan:solis_8113_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8113:-:*:*:*:*:*:*:*

Configuration 64

AND

OR

cpe:2.3:o:sloan:solis_8137_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8137:-:*:*:*:*:*:*:*

Configuration 65

AND

OR

cpe:2.3:o:sloan:solis_bpw_8000_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_bpw_8000:-:*:*:*:*:*:*:*

Configuration 66

AND

OR

cpe:2.3:o:sloan:solis_8116_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8116:-:*:*:*:*:*:*:*

Configuration 67

AND

OR

cpe:2.3:o:sloan:solis_8111_bt_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8111_bt:-:*:*:*:*:*:*:*

Configuration 68

AND

OR

cpe:2.3:o:sloan:solis_8153_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8153:-:*:*:*:*:*:*:*

Configuration 69

AND

OR

cpe:2.3:o:sloan:solis_8186_bt_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_8186_bt:-:*:*:*:*:*:*:*

Configuration 70

AND

OR

cpe:2.3:o:sloan:solis_ress-c_bt_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_ress-c_bt:-:*:*:*:*:*:*:*

Configuration 71

AND

OR

cpe:2.3:o:sloan:solis_ress-u_bt_firmware:-:*:*:*:*:*:*:*

OR

cpe:2.3:h:sloan:solis_ress-u_bt:-:*:*:*:*:*:*:*