SwitchBot vulnerabilities
We track 4 vulnerabilities in SwitchBot products across 13 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 9, 2026.
Latest SwitchBot vulnerabilities
- 8.5 High severity
SwitchBot Lock: Generation of Weak Initialization Vector (IV)
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
- 8.6 High severity
Smart Video Doorbell: Active Debug Code
Smart Video Doorbell firmware versions prior to 2.01.078 contain an active debug code vulnerability that allows an attacker to connect via Telnet and gain access to the device.
- 9.1 Critical severity
switchbot_firmware: Incorrect Authorization
An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firmware update process.
- 7.5 High severity
Mini Smart Wi-fi Plug Firmware: Incorrect Permission Assignment for Critical Resource
Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee LED Strip v.3.00.42, switchBot Hub2 v.1.0-0.8, Phillips hue hub v.1.59.1959097030, and yeelight smart lamp v.1.12.69 allo