What’s Vulnerable › Vulnerabilities

CVE-2021-20107

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-30 · updated 2026-06-17
• Weakness: CWE-306

Description

There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance.

Affected products

• Sloan Basys Efx-100 Firmware: all versions
• Sloan Basys Efx-150 Firmware: all versions
• Sloan Basys Efx-175 Firmware: all versions
• Sloan Basys Efx-177 Firmware: all versions
• Sloan Basys Efx-180 Firmware: all versions
• Sloan Basys Efx-200 Firmware: all versions
• Sloan Basys Efx-250 Firmware: all versions
• Sloan Basys Efx-275 Firmware: all versions
• Sloan Basys Efx-277 Firmware: all versions
• Sloan Basys Efx-280 Firmware: all versions
• Sloan Basys Efx-300 Firmware: all versions
• Sloan Basys Efx-350 Firmware: all versions
• Sloan Basys Efx-375 Firmware: all versions
• Sloan Basys Efx-377 Firmware: all versions
• Sloan Basys Efx-380 Firmware: all versions
• Sloan Basys Efx-600 Firmware: all versions
• Sloan Basys Efx-650 Firmware: all versions
• Sloan Basys Efx-675 Firmware: all versions
• Sloan Basys Efx-677 Firmware: all versions
• Sloan Basys Efx-680 Firmware: all versions
• Sloan Basys Efx-800 Firmware: all versions
• Sloan Basys Efx-850 Firmware: all versions
• Sloan Optima Eaf-100 Firmware: all versions
• Sloan Optima Eaf-150 Firmware: all versions
• Sloan Optima Eaf-200 Firmware: all versions
• Sloan Optima Eaf-225 Firmware: all versions
• Sloan Optima Eaf-250 Firmware: all versions
• Sloan Optima Eaf-275 Firmware: all versions
• Sloan Optima Eaf-350 Firmware: all versions
• Sloan Optima Eaf-700 Firmware: all versions

References

• https://www.tenable.com/security/research/tra-2021-26-0
• https://www.tenable.com/security/research/tra-2021-26-0

Get alerted when CVE-2021-20107 or the next vulnerability affects your stack