CVE-2026-8374 ‒ Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication
Description
Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.
Vulnerability
The BLE communication uses AES-CTR, which is highly susceptible to bit-flipping attacks if implemented without a Message Authentication Code (MAC), as is the case here. Bit flips in the ciphertext propagate directly to the plaintext.
The XOR difference between an encrypted LOCK command and an encrypted UNLOCK command is constant across all sessions and all locks running the same firmware.
This enables a trivial setup-and-execute attack:
- The attacker calculates the static difference (
diff = ENCRYPTED_LOCK_COMMAND ^ ENCRYPTED_UNLOCK_COMMAND) using a test device. - The attacker approaches the target lock and presses the physical “Lock” button on the keypad, forcing it to transmit an encrypted
LOCKcommand over BLE in the default configuration. - The attacker captures this payload and applies the pre-computed difference:
CRAFTED_ENCRYPTED_UNLOCK = ENCRYPTED_LOCK ^ diff. - The crafted payload is replayed to the lock. The lock decrypts the manipulated payload, interprets it as a valid
UNLOCKcommand, and unlocks the door.
Mitigation
Update your devices to the latest firmware version. According to SwitchBot, the following versions should have the relevant fixes installed.
Lock:
- SwitchBot Lock: V7.7 and later
- SwitchBot Lock Pro: V3.7 and later
- SwitchBot Lock WiFi: V15.21 and later
- SwitchBot Lock Ultra: V2.8 and later
- SwitchBot Lock Lite: V7.7 and later
Keypad:
- SwitchBot Keypad: V2.9 and later
- SwitchBot Keypad Touch: V2.9 and later
- SwitchBot Keypad Vision: V2.5 and later
- SwitchBot Keypad Vision Pro: V1.0 and later
App: SwitchBot App: V9.18 and later
Disclosure Timeline
| Date | Action |
|---|---|
| 15.07.2025 | Initial report sent to vendor |
| 17.07.2025 | Vendor provides beta patch for testing |
| 13.08.2025 | Patch circumvention (legacy protocol downgrade) reported |
| 27.08.2025 | Vendor acknowledges bypass; estimates 6 months for ecosystem-wide protocol deprecation |
| 02.04.2026 | Vendor shares final updated firmware |
| 09.10.2026 | Public disclosure |