CVE-2026-112345: TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-26 · updated 2026-10-27
Weakness: CWE-321

Description

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

Affected products

Sciener TTLock: before 9.8.260718 — fixed in 9.8.260718

How to fix

Upgrade to a fixed version: Sciener TTLock 9.8.260718. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-112345 or the next vulnerability affects your stack