{"id":"CVE-2018-20958","aliases":["EUVD-2018-13496","GHSA-wf9p-rrmg-53wp"],"status":"published","title":"The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and...","description":"The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00499,"percentile":0.4303,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2019-08-07T12:43:00Z","modified":"2026-06-17T01:53:49Z","products":[{"vendor":"tapplock","product":"tapplock_firmware"}],"references":[{"url":"https://www.pentestpartners.com/security-blog/totally-pwning-the-tapplock-smart-lock/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://tapplock.com/notice/20180612/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20958"},{"url":"https://tapplock.com/notice/20180612"},{"url":"https://www.pentestpartners.com/security-blog/totally-pwning-the-tapplock-smart-lock"},{"url":"https://github.com/advisories/GHSA-wf9p-rrmg-53wp"}],"sources":{"cve":[{"id":"CVE-2018-20958","description":"The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.","status":"published","published":"2019-08-07T12:43:00Z","modified":"2024-08-05T12:19:26.324Z","updated_at":"2026-11-02T14:35:00.237825Z"}],"euvd":[{"id":"EUVD-2018-13496","description":"The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.","status":"published","published":"2019-08-07T12:43:00Z","modified":"2024-08-05T12:19:26Z","updated_at":"2026-11-03T02:39:29.197639Z"}],"ghsa":[{"id":"GHSA-wf9p-rrmg-53wp","title":"The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and...","description":"The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.","status":"published","published":"2022-05-24T16:52:44Z","modified":"2024-04-04T01:34:45Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:55:59.982185Z"}],"nvd":[{"id":"CVE-2018-20958","description":"The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.","status":"published","published":"2019-08-07T13:15:13.373Z","modified":"2026-06-17T01:53:49.44Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.3,"vector":"AV:A/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:59.278647Z"}]}}