PatchTheCVECVE-2018-6402: Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network w
CVE-2018-6402 is a high-severity flaw (CVSS 7.5) affecting ecobee4 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stronger signal. An attacker must be able to set up a nearby SSID, similar to an "Evil Twin" attack.
Why this priority
- High severity
- Public exploit reference
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Adjacent network |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 84%) |
| CISA exploited list | No |
| Weakness | CWE-327 |
| Published | 2020-04-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2018-6402?
ecobee4 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2018-6402 being exploited?
CVE-2018-6402 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2018-6402 affect?
CVE-2018-6402 affects ecobee4 firmware. Severity is high (CVSS 7.5). Ecobee Ecobee4 4.2.0.171 devices can be forced to deauthenticate and connect to an unencrypted Wi-Fi network with the same SSID, even if the device settings specify use of encryption such as WPA2, as long as the competing network has a stro
How urgent is CVE-2018-6402?
Priority 35/100. High severity; Public exploit reference