What’s Vulnerable › Vulnerabilities

CVE-2026-8374: Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication

• Severity: high (CVSS 8.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-09 · updated 2026-10-30
• Weakness: CWE-1204

Description

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

Affected products

• SwitchBot App: before 9.18 — fixed in 9.18
• SwitchBot Keypad: before 2.9 — fixed in 2.9
• SwitchBot Keypad Touch: before 2.9 — fixed in 2.9
• SwitchBot Keypad Vision: before 2.5 — fixed in 2.5
• SwitchBot Keypad Vision Pro: before 1.0 — fixed in 1.0
• SwitchBot Lock: before 7.7 — fixed in 7.7
• SwitchBot Lock Lite: before 7.7 — fixed in 7.7
• SwitchBot Lock Pro: before 3.7 — fixed in 3.7
• SwitchBot Lock Ultra: before 2.8 — fixed in 2.8
• SwitchBot Lock Wifi: before 15.21 — fixed in 15.21

How to fix

Upgrade to a fixed version: SwitchBot App 9.18; SwitchBot Keypad 2.9; SwitchBot Keypad Touch 2.9; SwitchBot Keypad Vision 2.5; SwitchBot Keypad Vision Pro 1.0; SwitchBot Lock 7.7; SwitchBot Lock Lite 7.7; SwitchBot Lock Pro 3.7; SwitchBot Lock Ultra 2.8; SwitchBot Lock Wifi 15.21. Check the vendor advisory for mitigations.

References

• https://neodyme.io/en/advisories/cve-2026-8374/
• https://neodyme.io/en/blog/switchbot/

Get alerted when CVE-2026-8374 or the next vulnerability affects your stack