CVE-2021-20107: Sloan Basys Efx-100 Firmware

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance.

Affected products

  • Sloan Basys Efx-100 Firmware: affected versions not specified
  • Sloan Basys Efx-150 Firmware: affected versions not specified
  • Sloan Basys Efx-175 Firmware: affected versions not specified
  • Sloan Basys Efx-177 Firmware: affected versions not specified
  • Sloan Basys Efx-180 Firmware: affected versions not specified
  • Sloan Basys Efx-200 Firmware: affected versions not specified
  • Sloan Basys Efx-250 Firmware: affected versions not specified
  • Sloan Basys Efx-275 Firmware: affected versions not specified
  • Sloan Basys Efx-277 Firmware: affected versions not specified
  • Sloan Basys Efx-280 Firmware: affected versions not specified
  • Sloan Basys Efx-300 Firmware: affected versions not specified
  • Sloan Basys Efx-350 Firmware: affected versions not specified
  • Sloan Basys Efx-375 Firmware: affected versions not specified
  • Sloan Basys Efx-377 Firmware: affected versions not specified
  • Sloan Basys Efx-380 Firmware: affected versions not specified
  • Sloan Basys Efx-600 Firmware: affected versions not specified
  • Sloan Basys Efx-650 Firmware: affected versions not specified
  • Sloan Basys Efx-675 Firmware: affected versions not specified
  • Sloan Basys Efx-677 Firmware: affected versions not specified
  • Sloan Basys Efx-680 Firmware: affected versions not specified
  • Sloan Basys Efx-800 Firmware: affected versions not specified
  • Sloan Basys Efx-850 Firmware: affected versions not specified
  • Sloan Optima Eaf-100 Firmware: affected versions not specified
  • Sloan Optima Eaf-150 Firmware: affected versions not specified
  • Sloan Optima Eaf-200 Firmware: affected versions not specified
  • and 46 more

Published 2021-06-30. Last modified 2026-06-17.