CVE-2018-20958: Tapplock Firmware

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.

Affected products

• Tapplock Tapplock Firmware: before 2018-06-12 (fixed in 2018-06-12)

Published 2019-08-07. Last modified 2026-06-17.