Echelon manufactures building automation and IoT controllers, principally the i.lon and SmartServer product lines, which manage networked environmental systems and integrate legacy devices via standardized protocols. Its vulnerability disclosures cluster around authentication and credential-handling weaknesses—including authentication bypass via alternate paths, cleartext storage and transmission of sensitive data, and improper credential validation—reflecting the legacy interoperability constraints and embedded design of networked control systems. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Echelon over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-3089CRITICAL
Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartSer | Feb 13, 2023 | 9.8 | 31 | NO | NO |
CVE-2018-8859CRITICAL Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can bypass the required au | Jul 24, 2018 | 9.8 | 29 | NO | NO |
CVE-2018-8851CRITICAL Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices store passwords in plainte | Jul 24, 2018 | 9.8 | 29 | NO | NO |
CVE-2018-8855CRITICAL Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. The devices allow unencrypted Web conn | Jul 24, 2018 | 9.8 | 28 | NO | NO |
CVE-2018-10627CRITICAL Echelon SmartServer 1 all versions, SmartServer 2 all versions prior to release 4.11.007, i.LON 100 all versions, and i.LON 600 all versions. An attacker can use the SOAP API to re | Jul 24, 2018 | 9.8 | 28 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Echelon.
Media articles that mention a CVE ID that affects a product developed by Echelon — matched by CVE ID, not by vendor name.