SwitchBot Lock: Generation of Weak Initialization Vector (IV)
CVE-2026-8374 is a high-severity generation of weak initialization vector (IV) vulnerability in SwitchBot Lock from SwitchBot, with a CVSS 4.0 base score of 8.5 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists version 7.7 as the first without the flaw, so updating SwitchBot Lock to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.09% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update SwitchBot Lock to 7.7 or a later version.
- Update SwitchBot Lock Pro to 3.7 or a later version.
- Update SwitchBot Lock Wifi to 15.21 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| SwitchBot | SwitchBot Lock | before 7.7 | 7.7 |
| SwitchBot | SwitchBot Lock Pro | before 3.7 | 3.7 |
| SwitchBot | SwitchBot Lock Wifi | before 15.21 | 15.21 |
| SwitchBot | SwitchBot Lock Ultra | before 2.8 | 2.8 |
| SwitchBot | SwitchBot Lock Lite | before 7.7 | 7.7 |
| SwitchBot | SwitchBot Keypad | before 2.9 | 2.9 |
| SwitchBot | SwitchBot Keypad Touch | before 2.9 | 2.9 |
| SwitchBot | SwitchBot Keypad Vision | before 2.5 | 2.5 |
| SwitchBot | SwitchBot Keypad Vision Pro | before 1.0 | 1.0 |
| SwitchBot | SwitchBot App | before 9.18 | 9.18 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- NoneThe attack does not depend on a particular deployment or configuration.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- LowLimited loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- HighSerious loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- HighSerious loss of availability on the vulnerable system.
- Confidentiality (other systems)
- LowLimited loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- HighSerious loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- HighSerious loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:I/V:D/RE:H/U:Red. Scored by CNA.
Official description
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Generation of Weak Initialization Vector (IV)
The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
More Generation of Weak Initialization Vector (IV) vulnerabilities (CWE-1204)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Recent Generation of Weak Initialization Vector (IV) vulnerabilities
- 7.5 High severity
Spotted an error? Tell us.