CVE-2018-20958

The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.

Score

CVSS 3.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2019-08-07

Last modified

2024-08-05

Weaknesses

CWE-200

Affected products

• Tapplock Firmware (Tapplock)

References

• https://tapplock.com/notice/20180612/
• https://www.pentestpartners.com/security-blog/totally-pwning-the-tapplock-smart-lock/