CVE-2021-40825

nLight ECLYPSE (nECY) system Controllers running software prior to 1.17.21245.754 contain a default key vulnerability. The nECY does not force a change to the key upon the initial configuration of an affected device. nECY system controllers utilize an encrypted channel to secure SensorViewTM configuration and monitoring software and nECY to nECY communications. Impacted devices are at risk of exploitation. A remote attacker with IP access to an impacted device could submit lighting control commands to the nECY by leveraging the default key. A successful attack may result in the attacker gaining the ability to modify lighting conditions or gain the ability to update the software on lighting devices. The impacted key is referred to as the SensorView Password in the nECY nLight Explorer Interface and the Gateway Password in the SensorView application. An attacker cannot authenticate to or modify the configuration or software of the nECY system controller.

• CWE-1188

• https://insights.acuitybrands.com/psirt-blog-2369078/nlight-eclypse-default-key-vulnerabiliyVendor Advisory
• https://www.acuitybrands.com/products/detail/588952/nlight/necy-system-controller/nlight-eclypset-system-controllerProduct, Vendor Advisory
• https://insights.acuitybrands.com/psirt-blog-2369078/nlight-eclypse-default-key-vulnerabiliyVendor Advisory
• https://www.acuitybrands.com/products/detail/588952/nlight/necy-system-controller/nlight-eclypset-system-controllerProduct, Vendor Advisory

Published

Sep 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40814The Customer Photo Gallery addon before 2.9.4 for PrestaShop…9.8
• CVE-2021-40818scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a…9.8
• CVE-2021-4082pimcore is vulnerable to Cross-Site Request Forgery (CSRF)4.3
• CVE-2021-40822GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SS…7.5
• CVE-2021-40823A logic error in the room key sharing functionality of matri…5.9
• CVE-2021-40824A logic error in the room key sharing functionality of Eleme…5.9
• CVE-2021-40826Clementine Music Player through 1.3.1 is vulnerable to a Use…7.8
• CVE-2021-40827Clementine Music Player through 1.3.1 (when a GLib 2.0.0 DLL…7.8
• CVE-2021-40828Connections initialized by the AWS IoT Device SDK v2 for Jav…8.8
• CVE-2021-40829Connections initialized by the AWS IoT Device SDK v2 for Jav…8.8
• CVE-2021-4083A read-after-free memory flaw was found in the Linux kernel'…7
• CVE-2021-40830The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js …8.8