| August Smart Lock Pro
|
|
Security Grade
Calculator v
|
August Smart Lock Pro
Release Date: 2018-06-12 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
|
| Prior attacks
|
None
|
🔗 Proof
|
|
| Updatability
|
Very common
|
🔗 Proof
|
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Full
|
🔗 Proof
|
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
|
| Category Score
|
Score: 1 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
|
| Authentication
|
Secure
|
🔗 Proof
|
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
|
| Event logging
|
Access event logged
|
🔗 Proof
|
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
|
| Category Score
|
Score: 1 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Embedded lock firmware (Companion App: August Home App)
|
| Hardware (CPU / GPU)
|
CPU: Embedded ARM MCU • GPU: None
|
| Memory & Storage
|
Memory: Not publicly disclosed • Storage: Internal flash storage
|
| Power, Battery & Charging
|
Battery: 4 AA alkaline batteries • Power: Battery powered • Charging: No external charging
|
| Display & Camera
|
Display: None • Camera: None
|
| Sound & Connectivity
|
Sound: Buzzer for status alerts • Connectivity: Bluetooth 4.0, Z-Wave Plus, 2.4GHz Wi-Fi (with bridge)
|
| Physical (Dimensions & Mass)
|
Dimensions: 86 × 56.4 mm • Mass: 394 g
|
Device Overview
- Manufacturer: August Home
- Model Number: August Smart Lock Pro
- Firmware Versions affected: 7.2.1 and earlier
- Use-case: Bluetooth + Wi-Fi enabled smart deadbolt, remote unlock, guest access code management.
Vulnerabilities & Attack Surface
- CVE ID: CVE-2019-15062
- Vulnerability description: Bluetooth communication uses insufficiently authenticated commands. Nearby attackers can replay unlock signals under certain conditions.
- Attack vector: Bluetooth radio proximity.
CIA Triad Impact Analysis
- Confidentiality: Attackers may capture unlock command traces and access event logs.
- Integrity: Replayed commands can trigger unauthorized door unlocking.
- Availability: Continuous Bluetooth spam packets can jam the lock’s radio module.
Mitigations / Countermeasures
- 1. Install the newest firmware patch from August.
- 2. Remove unused guest access codes regularly.
- 3. Keep the lock’s Bluetooth range physically constrained.
- 4. Enable account two-factor authentication in the mobile app.
References
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15062
[2] August security release note
