CVE-2018-20100

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered on August Connect devices. Insecure data transfer between the August app and August Connect during configuration allows attackers to discover home Wi-Fi credentials. This data transfer uses an unencrypted access point for these credentials, and passes them in an HTTP POST, using the AugustWifiDevice class, with data encrypted with a fixed key found obfuscated in the app.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://dojo.bullguard.com/dojo-by-bullguard/blog/august-connect/Third Party Advisory
https://dojo.bullguard.com/dojo-by-bullguard/blog/august-connect/Third Party Advisory

Timeline

Published: Jan 2, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-201016.1The codection "Import users from CSV with meta" plugin before 1.12.1 for WordPress allows XSS via the value of a cell.CVE-2018-201027.5An out-of-bounds read in dns_validate_dns_response in dns.c was discovered in HAProxy through 1.8.14. Due to a missing check when validating CVE-2018-201037.5An issue was discovered in dns.c in HAProxy through 1.8.14. In the case of a compressed pointer, a crafted packet can trigger infinite recur CVE-2018-201055.5A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local CVE-2018-201068.1In yast2-printer up to and including version 4.0.2 the SMB printer settings don't escape characters in passwords properly. If a password wit CVE-2018-20115.3IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that CVE-2018-201149.8On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cg CVE-2018-201216.1Podcast Generator 2.7 has stored cross-site scripting (XSS) via the URL addcategory parameter.CVE-2018-201229.8The web interface on FASTGate Fastweb devices with firmware through 0.00.47_FW_200_Askey 2017-05-17 (software through 1.0.1b) exposed a CGI CVE-2018-201235.5pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.CVE-2018-201245.5hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge val CVE-2018-201257.5hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in