CVE-2018-20100 An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to discover home Wi-Fi credentials. This data....
CriticalCVSS 9.8
EPSS 0.71%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to discover home Wi-Fi credentials. This data transfer uses an unencrypted access point for these credentials, and passes them in an HTTP POST, using the AugustWifiDevice class, with data encrypted with a fixed key found obfuscated in the app.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| august connect | All versions | No fix listed |
| august connect firmware | All versions | No fix listed |
References
- dojo.bullguard.com third-party-advisory