Sciener TTLock: Hardcoded cryptographic key in BLE pairing
Summary
The TTLock Android app before 9.8.260718 and the associated smart-lock firmware use a static AES key (defaultKey) that is identical across devices. An attacker within Bluetooth range can capture the pairing exchange, decrypt the persistent session key and forge authenticated requests. This allows unlocking the device, adding fingerprints or access codes and performing administrative actions without authentication or user interaction.
Affected
- Sciener TTLock Android app before 9.8.260718
- Associated TTLock smart-lock firmware (affected versions unknown)
Fixed in
- TTLock Android app 9.8.260718 or later (fix reported by third-party advisories; no vendor advisory found)
- Firmware: Unknown.
Workaround
- No workaround documented.
- Restrict who holds the app and admin rights.
- Review fingerprint and access-code lists and lock logs for unknown entries.
Exploitation
- Not known to be exploited; no CISA KEV listing found.
- CISA SSVC: exploitation status 'poc', not automatable, total technical impact.
- Public proof-of-concept status unclear.
Our recommendation
- Update the TTLock app to 9.8.260718 or later on all admin devices.
- Ask Sciener/TTLock whether locks already paired need a firmware update.
- Review access lists and lock logs for unknown entries.
- Prioritise locks in areas where unknown people can be nearby, and restrict Bluetooth proximity where possible.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: TTLock Android App Hardcoded BLE Pairing Key Exposure www.vulncheck.com
- Yassine Damiri: CVE-2026-112345 write-up damiri.fr
- VulDB entry 426462 vuldb.com
- OpenCVE: CVE-2026-112345 app.opencve.io
- OffSeq Radar: CVE-2026-112345 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:06.
Original description (NVD)
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.