Search
Find a vulnerability
Search criteria
1 vulnerability found for SwitchBot Lock Pro by SwitchBot
CVE-2026-8374 (GCVE-0-2026-8374)
Vulnerability from cvelistv5 – Published: 2026-10-09 12:09 – Updated: 2026-10-30 16:07
VLAI
EPSS
VEX
Title
Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication
Summary
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 17:57 UTC
CWE
Assigner
cirosec
CNA
References
2 references
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| SwitchBot | SwitchBot Lock |
Affected:
0 , < 7.7
(custom)
|
|
| SwitchBot | SwitchBot Lock Pro |
Affected:
0 , < 3.7
(custom)
|
|
| SwitchBot | SwitchBot Lock Wifi |
Affected:
0 , < 15.21
(custom)
|
|
| SwitchBot | SwitchBot Lock Ultra |
Affected:
0 , < 2.8
(custom)
|
|
| SwitchBot | SwitchBot Lock Lite |
Affected:
0 , < 7.7
(custom)
|
|
| SwitchBot | SwitchBot Keypad |
Affected:
0 , < 2.9
(custom)
|
|
| SwitchBot | SwitchBot Keypad Touch |
Affected:
0 , < 2.9
(custom)
|
|
| SwitchBot | SwitchBot Keypad Vision |
Affected:
0 , < 2.5
(custom)
|
|
| SwitchBot | SwitchBot Keypad Vision Pro |
Affected:
0 , < 1.0
(custom)
|
|
| SwitchBot | SwitchBot App |
Affected:
0 , < 9.18
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8374",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:57:54.302937Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:02:36.799Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Lock",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "7.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Lock Pro",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "3.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Lock Wifi",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "15.21",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Lock Ultra",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "2.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Lock Lite",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "7.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Keypad",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Keypad Touch",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "2.9",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Keypad Vision",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "2.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"product": "SwitchBot Keypad Vision Pro",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "1.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"platforms": [
"Android"
],
"product": "SwitchBot App",
"vendor": "SwitchBot",
"versions": [
{
"lessThan": "9.18",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aaron Kaiser (Neodyme AG)"
},
{
"lang": "en",
"type": "finder",
"value": "Tobias Madl (Neodyme AG)"
},
{
"lang": "en",
"type": "finder",
"value": "Justin Mietzner (Neodyme AG)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol."
}
],
"value": "Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol."
}
],
"impacts": [
{
"capecId": "CAPEC-395",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-395 Bypassing Electronic Locks and Access Controls"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "IRRECOVERABLE",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:P/AU:N/R:I/V:D/RE:H/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1204",
"description": "CWE-1204 Generation of weak initialization vector (IV)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1240",
"description": "CWE-1240 Use of a cryptographic primitive with a risky implementation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T16:07:44.121Z",
"orgId": "a341c0d1-ebf7-493f-a84e-38cf86618674",
"shortName": "cirosec"
},
"references": [
{
"url": "https://neodyme.io/en/advisories/cve-2026-8374/"
},
{
"url": "https://neodyme.io/en/blog/switchbot/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "a341c0d1-ebf7-493f-a84e-38cf86618674",
"assignerShortName": "cirosec",
"cveId": "CVE-2026-8374",
"datePublished": "2026-10-09T12:09:07.506Z",
"dateReserved": "2026-05-12T07:14:40.536Z",
"dateUpdated": "2026-10-30T16:07:44.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}