CVE-2018-20100

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-01-02 · updated 2026-06-17
Weakness: CWE-311

Description

An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to discover home Wi-Fi credentials. This data transfer uses an unencrypted access point for these credentials, and passes them in an HTTP POST, using the AugustWifiDevice class, with data encrypted with a fixed key found obfuscated in the app.

Affected products

August Connect: all versions
August Connect Firmware: all versions

References

https://dojo.bullguard.com/dojo-by-bullguard/blog/august-connect/
https://dojo.bullguard.com/dojo-by-bullguard/blog/august-connect/

Get alerted when CVE-2018-20100 or the next vulnerability affects your stack