SwitchBot Door Lock CVE-2026-8374

Attacker must be within Bluetooth (BLE) radio proximity of a SwitchBot Door Lock Series device and interact with its wireless communication protocol; the flaw (CWE-1204, weak initialization vector / cryptographic misuse) lets the attacker bypass the lock's authentication without any valid credential, PIN, or app pairing (PR:N, UI:N), affecting default deployments of the lock, keypad, and companion app. Limiting factors: exploitation is non-remote and does not scale - it requires per-target physical proximity within BLE range (~10 m) and the ability to interact with/observe the lock's live Bluetooth traffic, so it is suited to targeted physical intrusion rather than widespread attack.

This is a genuine physical-security risk but narrower in reach than the 8.5 score alone suggests. The input CVSS 4.0 vector specifies AV:L (local) with AC:L/PR:N/UI:N, meaning no authentication and no user interaction, but because the attack targets Bluetooth communication the realistic vector is adjacent/proximity-based - an attacker must be within BLE radio range (roughly 10 m) of the target lock. The vulnerable-system impact is significant (VI:H/VA:H, integrity and availability of the lock's access-control state) with subsequent-system impact (SI:H/SA:H) reflecting compromise of the physical door/premises the lock protects. No EPSS score, no CISA KEV listing, and no explicit POC flag were provided, so there is no public exploit identified at time of analysis; however, a detailed vendor-independent advisory and technical blog from neodyme are referenced, which typically lower the bar to practical exploitation even without packaged exploit code. Net: a real, targeted physical-intrusion priority for owners of affected SwitchBot locks, but not a mass/remote/internet-exploitable issue - exploitation does not scale and requires an attacker physically near each target. Note the AV:L designation is debatable: Bluetooth normally maps to AV:A (adjacent); verify intended attack range with the vendor/researcher.

An attacker positions themselves within Bluetooth range of a SwitchBot Door Lock and manipulates the BLE communication protocol, abusing the weak/misused cryptographic handshake (CWE-1204) to bypass the lock's authentication and access controls. With no credentials or user interaction required (PR:N/UI:N), the attacker sends crafted protocol messages that cause the lock to open. A public technical advisory and blog describe the flaw, but no standalone proof-of-concept exploit tool is flagged in the provided data.