CVE-2018-20100
📋 TL;DR
This vulnerability allows attackers to intercept Wi-Fi credentials during the configuration of August Connect smart lock devices. Attackers within wireless range can capture home network passwords transmitted insecurely between the August app and the Connect device. This affects users of August Connect devices configured via the vulnerable August app.
💻 Affected Systems
- August Connect Wi-Fi Bridge
- August Smart Lock Pro + Connect
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to home Wi-Fi network, enabling further attacks on connected devices, data interception, and potential network compromise.
Likely Case
Local attackers capture Wi-Fi credentials, gaining unauthorized network access and potentially compromising other connected smart home devices.
If Mitigated
With proper network segmentation and monitoring, impact limited to isolated smart home network segment.
🎯 Exploit Status
Attack requires proximity during device setup; tools for Wi-Fi packet capture widely available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: August app updates and Connect firmware updates released in 2018
Vendor Advisory: https://support.august.com/hc/en-us/articles/360018406793
Restart Required: Yes
Instructions:
1. Update August mobile app to latest version. 2. Ensure August Connect device firmware is updated via app. 3. Reconfigure device if previously set up with vulnerable version.
🔧 Temporary Workarounds
Secure Configuration Environment
allConfigure August Connect in a secure, private location away from potential eavesdroppers
Temporary Network Isolation
allSet up device on temporary isolated network, then move to main network after configuration
🧯 If You Can't Patch
- Physically secure configuration area to prevent local attackers from intercepting setup traffic
- Use wired configuration if supported, or configure in RF-shielded environment
🔍 How to Verify
Check if Vulnerable:
Check if August app version is pre-2018 updates and if Connect device was configured before security patchesCheck Version:
Check app version in mobile app store; firmware version in August app device settingsVerify Fix Applied:
Verify August app is latest version and Connect firmware updated through app settings📡 Detection & Monitoring
Log Indicators:
- Unusual Wi-Fi configuration attempts
- Multiple failed connection attempts to August Connect
Network Indicators:
- Unencrypted HTTP POST traffic containing 'AugustWifiDevice' class data during device setup
SIEM Query:
search 'AugustWifiDevice' OR 'August Connect' in HTTP traffic during non-standard hours