CPATH-2026-0034 · General IoT

August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098)

A dominant data privacy path connects the public security record to a provisional HIGH consequence band.

Candidate bandHIGH
Dominant pathData privacy

This path is explicitly dominant because it reaches the record's highest candidate band, HIGH.

Causal model

What has to happen for this consequence to hold?

1 candidate path · explicit source, inference, and assumption boundaries.

Privacy · Dominant path

Data privacy

The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.

HIGH
  1. accessSource-backed

    Proximity or local access

    The attacker must be within Wi-Fi range while the August Connect provisioning exchange is occurring.

    EvidenceNVD

  2. boundaryModel inference

    Reusable multi-stage bridge

    A provisioning disclosure becomes a credential that can bridge into other systems on the home network.

    EvidenceNo direct citation — inspect the declared inference or assumption.

  3. capabilityModel inference

    Sensitive device or personal data

    The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.

    EvidenceNo direct citation — inspect the declared inference or assumption.

  4. consequenceModel inference

    Data privacy

    The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.

    EvidenceNo direct citation — inspect the declared inference or assumption.

  5. recoveryOperational assumption

    Coordinated operational recovery

    Recovery requires removing the embedded key through updated software and rotating any Wi-Fi password that may have been exposed.

    EvidenceNo direct citation — inspect the declared inference or assumption.

Decision rationale

Why this band?

The compact score is separated into the facts and judgments that produced it.

Reach and effort
ReachabilityRE 2
Proximity or local access

The attacker must be within Wi-Fi range while the August Connect provisioning exchange is occurring.

Source-backedNVD
Execution complexityEC 3
Reproducible exploit workflow

The demonstrated workflow captures setup traffic, reverses ROT13, and decrypts it with the static application key.

Source-backedNVD
ExposureEX 2
Access position limits exposure

The technique is easier to perform than it is to position against a target, so access is the constraining factor.

Model inference
Consequence
Physical / safetyPH 0
No direct physical effect

Disclosure of the Wi-Fi password does not itself actuate the smart lock.

Model inference
Data / perceptionDP 3
Sensitive device or personal data

The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.

Model inference
AuthorityAT 2
Bounded function authority

The password grants access to the victim network but does not directly grant lock administration or firmware authority.

Model inference
Scale and recovery
ChainabilityCH 3
Reusable multi-stage bridge

A provisioning disclosure becomes a credential that can bridge into other systems on the home network.

Model inference
Reuse scaleSR 4
Shared fleet-wide primitive

The static decryption key is shared across the product line, so the decryption method is portable.

Operational assumption
Execution scaleSX 2
Proximity-bound repetition

Each password still requires a nearby capture during that household's setup window despite the shared key.

Operational assumption
Recovery burdenOR 3
Coordinated operational recovery

Recovery requires removing the embedded key through updated software and rotating any Wi-Fi password that may have been exposed.

Operational assumption
Confidence and status
Evidence strengthEV 3
Reproduced or strongly report-backed

NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.

Source-backedNVD
LivenessLS Historical
Historical condition

The condition is retained as a historical case rather than a claim of current field exposure.

Source-backedNVD

Decision trail

How the final band follows

  1. Base bandHIGH
  2. No adjustment

    The HIGH base band remains final because no separate cap or systemic uplift applies. The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.

  3. Final candidate bandHIGH
Technical vector
Compact machine notationCPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:3/EX:2/PH:0/DP:3/AT:2/CH:3/SR:4/SX:2/OR:3/EV:3/LS:HISTORICALRead the scoring method →

Triage implication

Verify the privacy transition before acting on the band.

Protect the outward data or sensor boundary and verify what sensitive behavior can be reconstructed, not only what raw fields are exposed.

Evidence ledger

Public sources used by this record.

Every named source includes a public link. Path review remains separate from citation coverage.

Published baseline

Keep exploit severity and consequence reasoning distinct.

RelationshipPaths model is higher
Baseline confidencehigh
Scored2026-06-03
v3.1 · 6.5 MEDIUMNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
v3.1 · 3.5 LOWBitdefender via NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Original scorer notes

The source narrative behind the structured explanation.

Retained for provenance and historical review, not as the recommended way to understand the assessment.

Read the original scorer notes

Assessment

CFSE Consequence Paths assesses August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098) at HIGH — the worst of 1 risk path (perception). The dominant consequence is exposure of sensitive data.

Vulnerability

August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098). Reported attack vector: Adjacent network (AV:A); attacker within Wi-Fi range during/around device provisioning.

CFSE Consequence Paths analysis

The vulnerability is decomposed into one risk path per terminal consequence. Each path is scored on its exposure (reachability × execution complexity) and the authority, perception, and physical/safety it reaches, together with its scale of reuse, scale of execution, and recoverability.

DATA_PRIVACYHIGH

CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:3/EX:2/PH:0/DP:3/AT:2/CH:3/SR:4/SX:2/OR:3/EV:3/LS:HISTORICAL

Exposure EX=2 (reachability-bound) · bands PH=MONITOR · DP=HIGH · AT=ELEVATED → base HIGH · caps privacy-only cap → assessed HIGH.

  • Terminal consequence is exposure of the home Wi-Fi password in plaintext via a hardcoded static AES key (ROT13-obfuscated) in the companion app. RE:2 because exploitation requires Wi-Fi radio proximity during the provisioning window (AV:A, adjacent/local-net, not internet-exposed). EC:3 standard researcher workflow: capture setup traffic, undo ROT13, apply static AES; reproducible but constrained by the setup-window opportunity. PH:0 the flaw does not actuate the lock and no direct safety effect. DP:3 the leaked Wi-Fi password is a credential / sensitive secret (C:H), not merely PII or telemetry;
  • perception_feeds_action — false (no perception/world-model or safety-sensor state). AT:2 yields a bounded victim credential (the home Wi-Fi key) and a pivot to broader network authority, but does not grant lock control, admin/service authority, or any trust root. CH:3 the leaked Wi-Fi credential is a reusable cross-boundary bridge enabling lateral movement onto the home network and attacks on other devices;
  • boundary_crossing — true (device/app/network boundaries crossed). SR:4 the AES key is hardcoded and shared across the entire app/product line (a single reusable secret / supply-chain-scope artifact). SX:2 despite the shared key, each exploitation still needs proximity and a live capture during a setup window, so execution is per-device proximity rather than fleet-scale remote. OR:3 remediation needs an app/firmware update to remove the embedded key and users must rotate Wi-Fi credentials; vendor stopped responding, but it does not require recall/signing-root rotation/fleet reprovision so recovery_needs_fleet_action=false. EV:3 reproduced by Bitdefender. LS HISTORICAL per case.
  • active_exploitation — false (no in-the-wild exploitation reported).

Published baseline

  • v3.1 6.5 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — NVD
  • v3.1 3.5 LOW — CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N — Bitdefender via NVD

The published baseline above is retained for source review. The registry records the reachable consequence path, including deployment-specific cyber-physical consequence, physical/safety impact, scale, and recovery burden.

Sources

Related paths

Compare the boundary, not only the product.

Cite this entryCFSE Consequence Paths Registry 1.0-candidate, CPATH-2026-0034 (“August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098)”), paths.cfse.ai/CPATH-2026-0034 (published 2026-06-03).