Causal model
What has to happen for this consequence to hold?
1 candidate path · explicit source, inference, and assumption boundaries.
Privacy · Dominant path
Data privacy
The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.
Proximity or local access
The attacker must be within Wi-Fi range while the August Connect provisioning exchange is occurring.
EvidenceNVD
Reusable multi-stage bridge
A provisioning disclosure becomes a credential that can bridge into other systems on the home network.
EvidenceNo direct citation — inspect the declared inference or assumption.
Sensitive device or personal data
The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.
EvidenceNo direct citation — inspect the declared inference or assumption.
Data privacy
The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.
EvidenceNo direct citation — inspect the declared inference or assumption.
Coordinated operational recovery
Recovery requires removing the embedded key through updated software and rotating any Wi-Fi password that may have been exposed.
EvidenceNo direct citation — inspect the declared inference or assumption.
Decision rationale
Why this band?
The compact score is separated into the facts and judgments that produced it.
Reach and effort
- Reachability
RE 2 - Proximity or local access
The attacker must be within Wi-Fi range while the August Connect provisioning exchange is occurring.
- Execution complexity
EC 3 - Reproducible exploit workflow
The demonstrated workflow captures setup traffic, reverses ROT13, and decrypts it with the static application key.
- Exposure
EX 2 - Access position limits exposure
The technique is easier to perform than it is to position against a target, so access is the constraining factor.
Consequence
- Physical / safety
PH 0 - No direct physical effect
Disclosure of the Wi-Fi password does not itself actuate the smart lock.
- Data / perception
DP 3 - Sensitive device or personal data
The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.
- Authority
AT 2 - Bounded function authority
The password grants access to the victim network but does not directly grant lock administration or firmware authority.
Scale and recovery
- Chainability
CH 3 - Reusable multi-stage bridge
A provisioning disclosure becomes a credential that can bridge into other systems on the home network.
- Reuse scale
SR 4 - Shared fleet-wide primitive
The static decryption key is shared across the product line, so the decryption method is portable.
- Execution scale
SX 2 - Proximity-bound repetition
Each password still requires a nearby capture during that household's setup window despite the shared key.
- Recovery burden
OR 3 - Coordinated operational recovery
Recovery requires removing the embedded key through updated software and rotating any Wi-Fi password that may have been exposed.
Confidence and status
- Evidence strength
EV 3 - Reproduced or strongly report-backed
NVD supports a reproduced or strongly report-backed condition; this registry still keeps consequence review separate from exploit confirmation.
- Liveness
LS Historical - Historical condition
The condition is retained as a historical case rather than a claim of current field exposure.
Decision trail
How the final band follows
- Base bandHIGH
- No adjustment
The HIGH base band remains final because no separate cap or systemic uplift applies. The recovered home Wi-Fi password is a reusable network credential rather than ordinary device telemetry.
- Final candidate bandHIGH
Technical vector
CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:3/EX:2/PH:0/DP:3/AT:2/CH:3/SR:4/SX:2/OR:3/EV:3/LS:HISTORICALRead the scoring method →Triage implication
Verify the privacy transition before acting on the band.
Protect the outward data or sensor boundary and verify what sensitive behavior can be reconstructed, not only what raw fields are exposed.
Evidence ledger
Public sources used by this record.
Every named source includes a public link. Path review remains separate from citation coverage.
- advisoryNVD
NVD
Published baseline
Keep exploit severity and consequence reasoning distinct.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NCVE recordsCVE-2019-17098
Original scorer notes
The source narrative behind the structured explanation.
Retained for provenance and historical review, not as the recommended way to understand the assessment.
Read the original scorer notes
Assessment
CFSE Consequence Paths assesses August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098) at HIGH — the worst of 1 risk path (perception). The dominant consequence is exposure of sensitive data.
Vulnerability
August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098). Reported attack vector: Adjacent network (AV:A); attacker within Wi-Fi range during/around device provisioning.
CFSE Consequence Paths analysis
The vulnerability is decomposed into one risk path per terminal consequence. Each path is scored on its exposure (reachability × execution complexity) and the authority, perception, and physical/safety it reaches, together with its scale of reuse, scale of execution, and recoverability.
DATA_PRIVACY → HIGH
CPATH:1.0-candidate/TT:DATA_PRIVACY/RE:2/EC:3/EX:2/PH:0/DP:3/AT:2/CH:3/SR:4/SX:2/OR:3/EV:3/LS:HISTORICAL
Exposure EX=2 (reachability-bound) · bands PH=MONITOR · DP=HIGH · AT=ELEVATED → base HIGH · caps privacy-only cap → assessed HIGH.
- Terminal consequence is exposure of the home Wi-Fi password in plaintext via a hardcoded static AES key (ROT13-obfuscated) in the companion app. RE:2 because exploitation requires Wi-Fi radio proximity during the provisioning window (AV:A, adjacent/local-net, not internet-exposed). EC:3 standard researcher workflow: capture setup traffic, undo ROT13, apply static AES; reproducible but constrained by the setup-window opportunity. PH:0 the flaw does not actuate the lock and no direct safety effect. DP:3 the leaked Wi-Fi password is a credential / sensitive secret (C:H), not merely PII or telemetry;
- perception_feeds_action — false (no perception/world-model or safety-sensor state). AT:2 yields a bounded victim credential (the home Wi-Fi key) and a pivot to broader network authority, but does not grant lock control, admin/service authority, or any trust root. CH:3 the leaked Wi-Fi credential is a reusable cross-boundary bridge enabling lateral movement onto the home network and attacks on other devices;
- boundary_crossing — true (device/app/network boundaries crossed). SR:4 the AES key is hardcoded and shared across the entire app/product line (a single reusable secret / supply-chain-scope artifact). SX:2 despite the shared key, each exploitation still needs proximity and a live capture during a setup window, so execution is per-device proximity rather than fleet-scale remote. OR:3 remediation needs an app/firmware update to remove the embedded key and users must rotate Wi-Fi credentials; vendor stopped responding, but it does not require recall/signing-root rotation/fleet reprovision so recovery_needs_fleet_action=false. EV:3 reproduced by Bitdefender. LS HISTORICAL per case.
- active_exploitation — false (no in-the-wild exploitation reported).
Published baseline
- v3.1 6.5 MEDIUM —
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N— NVD - v3.1 3.5 LOW —
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N— Bitdefender via NVD
The published baseline above is retained for source review. The registry records the reachable consequence path, including deployment-specific cyber-physical consequence, physical/safety impact, scale, and recovery burden.
Sources
CFSE Consequence Paths Registry 1.0-candidate, CPATH-2026-0034 (“August Smart Lock Pro + Connect Wi-Fi password disclosure via hardcoded key (CVE-2019-17098)”), paths.cfse.ai/CPATH-2026-0034 (published 2026-06-03).