A threat actor sharing the same network as the ecobee3 can craft a malicious HTTP request which will cause the device to crash and reboot.
The Wireless Access Configuration (WAC) server used to connect the ecobee3 device to WiFi using an Apple device crashes when a specially crafted web request is received.
A threat actor can send a POST request to the endpoint http://<host>:1200/config and omit the 'Content-Type' header, which causes the 'HKProcessConfig ==> memcpy' function to read from address space 0x00000000, causing the main application (idtm) to crash. Once a crash has occurred the 'watchdog' will cause the device to reset.
A threat actor on the same network as the ecobee3 can send a crafted HTTP request that crashes the device and forces a reboot. Advisory L9-15-163 traces it to the Wireless Access Configuration server, and files the category as null dereference for ecobee3 lite version 4.5.81.200.
The ecobee3 lite crash is triggered by a POST request to the /config endpoint that omits the Content-Type header. The advisory states this makes the HKProcessConfig memcpy call read from address space 0x00000000, which crashes the main application, named idtm. The Wireless Access Configuration server listens on TCP port 1200.
Yes. The advisory states that once a crash has occurred the watchdog will cause the device to reset. The result is a crash and reboot of the ecobee3 rather than a persistent failure, and the advisory describes no code execution from this issue.
The advisory describes a threat actor sharing the same network as the ecobee3 sending the malicious HTTP request. It does not describe an internet facing attack path. Impact is listed as Unranked, and the advisory was first published on June 28, 2021 and last updated on January 22, 2024.