CVE-2026-8374
Full vulnerability record from the local CVENow database.
Description
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
Severity
HIGH
CVSS score
8.5
(v4.0)
Vulnerability status
Deferred
Source identifier
a341c0d1-ebf7-493f-a84e-38cf86618674
Published
2026-10-09 13:17:11.240000
Last modified
2026-10-30 17:17:30.820000
View original CVE JSON
{
"id": "CVE-2026-8374",
"sourceIdentifier": "a341c0d1-ebf7-493f-a84e-38cf86618674",
"published": "2026-10-09T13:17:11.240",
"lastModified": "2026-10-30T17:17:30.820",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol."
}
],
"affected": [
{
"source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
"affectedData": [
{
"vendor": "SwitchBot",
"product": "SwitchBot Lock",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "7.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot Lock Pro",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "3.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot Lock Wifi",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "15.21",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot Lock Ultra",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "2.8",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot Lock Lite",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "7.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot Keypad",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "2.9",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot Keypad Touch",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "2.9",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot Keypad Vision",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "2.5",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot Keypad Vision Pro",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"versions": [
{
"version": "0",
"lessThan": "1.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "SwitchBot",
"product": "SwitchBot App",
"defaultStatus": "unaffected",
"modules": [
"Bluetooth communication"
],
"platforms": [
"Android"
],
"versions": [
{
"version": "0",
"lessThan": "9.18",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:I/V:D/RE:H/U:Red",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "PRESENT",
"Automatable": "NO",
"Recovery": "IRRECOVERABLE",
"valueDensity": "DIFFUSE",
"vulnerabilityResponseEffort": "HIGH",
"providerUrgency": "RED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-15T17:57:54.302937Z",
"id": "CVE-2026-8374",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-1204"
},
{
"lang": "en",
"value": "CWE-1240"
}
]
}
],
"references": [
{
"url": "https://neodyme.io/en/advisories/cve-2026-8374/",
"source": "a341c0d1-ebf7-493f-a84e-38cf86618674"
},
{
"url": "https://neodyme.io/en/blog/switchbot/",
"source": "a341c0d1-ebf7-493f-a84e-38cf86618674"
}
]
}