PT-2019-9986 · August · August Connect

Publicado 2019-01-02 · Atualizado 2019-10-03 · CVE-2018-20100

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions August Connect devices (affected versions not specified)

Description An issue allows attackers to discover home Wi-Fi credentials due to insecure data transfer between the August app and August Connect during configuration. This data transfer uses an unencrypted access point for these credentials and passes them in an HTTP POST using the AugustWifiDevice class, with data encrypted with a fixed key found obfuscated in the app.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2018-20100

Produtos afetados

August Connect

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2018-20100 · Nota de Segurança
• https://dojo.bullguard.com/dojo-by-bullguard/blog/august-connect · Nota