CVE-2026-8374CWE-1204CWE-1240

CVE-2026-8374

published October 9, 2026

CVSS
8.5
EPSS
0%
Percentile
0.4
In the wild
Unconfirmed
What it is

Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

The record
Technical detail
CVSS
8.5 · NONE
CVSS v4.0
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/S:P/AU:N/R:I/V:D/RE:H/U:Red
EPSS
0.00089 · 0.4th percentile
Weaknesses
CWE-1204 · Generation of Weak Initialization Vector (IV); CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation
Published
2026-10-09T17:17Z
References (2)
https://neodyme.io/en/advisories/cve-2026-8374/ · a341c0d1-ebf7-493f-a84e-38cf86618674https://neodyme.io/en/blog/switchbot/ · a341c0d1-ebf7-493f-a84e-38cf86618674
EPSS history
Timeline
  • 11 OCT 03:32Z
    EPSS moved — → 0%
    epss
  • 09 OCT 12:09Z
    Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication
    cvelistv5
  • 09 OCT 12:09Z
    Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication
    cvelistv5