CVE-2018-20958
MEDIUMTapplock Firmware < 2018-06-12 - Unauthenticated Exposure of Sensitive Information via BLE MAC Address
Title source: llmDescription
The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.
References (2)
Core 2
Core References
Third Party Advisory x_refsource_misc
https://www.pentestpartners.com/security-blog/totally-pwning-the-tapplock-smart-lock/
Vendor Advisory x_refsource_confirm
https://tapplock.com/notice/20180612/
Scores
CVSS v3
6.5
EPSS
0.0050
EPSS Percentile
38.9%
Attack Vector
ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (1)
tapplock/tapplock_firmware
< 2018-06-12
Published
Aug 07, 2019
Tracked Since
Feb 18, 2026