CoreCVE
Back

HIGH

Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal

Published Apr 14, 2020

Description

Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal. An attacker must be able to set up a nearby SSID, similar to an "Evil Twin" attack.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-327

Broken Crypto Algorithm

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 14, 2020
Updated Aug 5, 2024
Reserved Jan 29, 2018
Link CVE-2018-6402
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2018-6402
Red Hat
Severity n/a
Public date n/a
Links CVE-2018-6402