CVE-2026-8374: SwitchBot Lock, слаба криптография

Описание

Оригинално описание

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

Засегнати продукти

• SwitchBot SwitchBot Lock: преди 7.7
• SwitchBot SwitchBot Lock Pro: преди 3.7
• SwitchBot SwitchBot Lock Wifi: преди 15.21
• SwitchBot SwitchBot Lock Ultra: преди 2.8
• SwitchBot SwitchBot Lock Lite: преди 7.7
• SwitchBot SwitchBot Keypad: преди 2.9
• SwitchBot SwitchBot Keypad Touch: преди 2.9
• SwitchBot SwitchBot Keypad Vision: преди 2.5
• SwitchBot SwitchBot Keypad Vision Pro: преди 1.0
• SwitchBot SwitchBot App: преди 9.18

Вид слабост

• CWE-1204 Generation of Weak Initialization Vector (IV)
• CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-8374
• https://nvd.nist.gov/vuln/detail/CVE-2026-8374
• https://neodyme.io/en/advisories/cve-2026-8374/
• https://neodyme.io/en/blog/switchbot/