PT-2019-9986 · August · August Connect

Published 2019-01-02 · Updated 2019-10-03 · CVE-2018-20100

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions August Connect devices (affected versions not specified)

Description An issue allows attackers to discover home Wi-Fi credentials due to insecure data transfer between the August app and August Connect during configuration. This data transfer uses an unencrypted access point for these credentials and passes them in an HTTP POST using the AugustWifiDevice class, with data encrypted with a fixed key found obfuscated in the app.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2018-20100

Affected Products

August Connect

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2018-20100 · Security Note
• https://dojo.bullguard.com/dojo-by-bullguard/blog/august-connect · Note