CVE-2026-8374: switchbot lock series app

Vulnerability summary

CVE-2026-8374 is a high (CVSS 8.5) vulnerability in switchbot lock series app. EPSS estimates a 0.09% chance of exploitation in the next 30 days, higher than 0.3% of scored vulnerabilities.

Timeline

1. 09-10-2026
   PublishedVulnerability first disclosed.
2. 15-10-2026
   Last modifiedVulnerability information updated.

Description

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

• CWE-1204Generation of Weak Initialization Vector (IV)The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
• CWE-1240Use of a Cryptographic Primitive with a Risky ImplementationTo fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.