Ecobee3 Lite Firmware

ecobee3_lite_firmware

Vendor: Ecobee • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-27954 1Ecobee 1Ecobee3 Lite Firmware Jun 17, 2026 Aug 3, 2021 N/A· v4 8.2 HIGH· v3 6.4 MEDIUM· v2 A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability...Show more A heap-based buffer overflow vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HKProcessConfig function of the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to force the device to connect to a SSID or cause a denial of service.Show less
CVE-2021-27953 1Ecobee 1Ecobee3 Lite Firmware Jun 17, 2026 Aug 3, 2021 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forc...Show more A NULL pointer dereference vulnerability exists on the ecobee3 lite 4.5.81.200 device in the HomeKit Wireless Access Control setup process. A threat actor can exploit this vulnerability to cause a denial of service, forcing the device to reboot via a crafted HTTP request.Show less
CVE-2021-27952 1Ecobee 1Ecobee3 Lite Firmware Jun 17, 2026 Aug 3, 2021 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader environment through the serial console.