Vulnerability · Published Oct 9, 2026 · Assigned by cirosec
CVE-2026-8374Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication
High 8.5
In plain English
A high-severity security flaw in SwitchBot App from SwitchBot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)<0.1%top 99.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SwitchBot | SwitchBot Lock | 0 – before 7.7 |
| SwitchBot | SwitchBot Lock Pro | 0 – before 3.7 |
| SwitchBot | SwitchBot Lock Wifi | 0 – before 15.21 |
| SwitchBot | SwitchBot Lock Ultra | 0 – before 2.8 |
| SwitchBot | SwitchBot Lock Lite | 0 – before 7.7 |
| SwitchBot | SwitchBot Keypad | 0 – before 2.9 |
| SwitchBot | SwitchBot Keypad Touch | 0 – before 2.9 |
| SwitchBot | SwitchBot Keypad Vision | 0 – before 2.5 |
| SwitchBot | SwitchBot Keypad Vision Pro | 0 – before 1.0 |
| SwitchBot | SwitchBot App | 0 – before 9.18 |
Weakness: CWE-1204, CWE-1240 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:P/AU:N/R:I/V:D/RE:H/U:Red