CVE-2019-17098 Use of Hard-coded Cryptographic Key vulnerability in August Connect Wi-Fi Bridge App
Attackers can decrypt intercepted Wi-Fi credentials due to hard-coded keys in the August Connect app and firmware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-17098?
CVE-2019-17098 is a low-severity vulnerability in August Connect Firmware, published on 30 Sep 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Use of hard-coded cryptographic key vulnerability in August Connect Wi-Fi Bridge App, Connect Firmware allows an attacker to decrypt an intercepted payload containing the Wi-Fi network authentication credentials. This issue affects: August Connect Wi-Fi Bridge App version v10.11.0 and prior versions on Android. August Connect Firmware version 2.2.12 and prior versions.
Which versions are affected by CVE-2019-17098?
It affects 2 products.
Products include August August Home, August Connect Wi-Fi Bridge Firmware.
How do I fix CVE-2019-17098?
No fix has been published for CVE-2019-17098 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-17098 being exploited?
There is no known exploitation of CVE-2019-17098 in the wild and no public exploit code.
Sources
Also known as GHSA-c75r-fv95-pffp.