PT-2020-9870 · August · August Connect Firmware+1

Bitdefender Labs · Published 2020-09-30 · Updated 2020-10-08 · CVE-2019-17098

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions August Connect Wi-Fi Bridge App versions v10.11.0 and prior August Connect Firmware versions 2.2.12 and prior

Description The issue is related to the use of a hard-coded cryptographic key in the August Connect Wi-Fi Bridge App and Connect Firmware, allowing an attacker to decrypt an intercepted payload containing Wi-Fi network authentication credentials.

Recommendations For August Connect Wi-Fi Bridge App versions v10.11.0 and prior, update to a version newer than v10.11.0 to resolve the issue. For August Connect Firmware versions 2.2.12 and prior, update to a version newer than 2.2.12 to resolve the issue. As a temporary workaround, consider restricting access to the Wi-Fi network to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

CVE-2019-17098

Affected Products

August Connect Firmware

August Connect Wi-Fi Bridge App

References · 4

• https://osv.dev/vulnerability/CVE-2019-17098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-17098 · Security Note
• https://t.me/cibsecurity/14950 · Telegram Post
• https://labs.bitdefender.com/2020/08/smart-locks-not-so-smart-with-wi-fi-security · Note