SwitchBot Door Lock Series: Bit-flipping attack on Bluetooth lock commands

Summary

SwitchBot smart locks and keypads use AES-CTR for Bluetooth Low Energy (BLE) commands without a message authentication code, so the ciphertext can be modified undetected. An attacker within Bluetooth range can capture an encrypted LOCK command, apply a constant XOR difference, and replay the result as an UNLOCK command, which opens the door without a key or physical tampering. The attack works in the default configuration, and the CNA record lists the affected Lock, Keypad and App versions.

Affected

• SwitchBot Lock: versions before 7.7 (CNA record)
• SwitchBot Lock Pro: versions before 3.7 (CNA record)
• SwitchBot Lock WiFi: versions before 15.21 (CNA record)
• SwitchBot Lock Ultra: versions before 2.8 (CNA record)
• SwitchBot Lock Lite: versions before 7.7 (CNA record)
• SwitchBot Keypad: versions before 2.9 (CNA record)
• SwitchBot Keypad Touch: versions before 2.9 (CNA record)
• SwitchBot Keypad Vision: versions before 2.5 (CNA record)
• SwitchBot Keypad Vision Pro: versions before 1.0 (CNA record)
• SwitchBot App: versions before 9.18 (CNA record)

Fixed in

• Unknown in NVD; NVD status is Deferred.
• Neodyme advisory, citing SwitchBot: Lock 7.7, Lock Pro 3.7, Lock WiFi 15.21, Lock Ultra 2.8, Lock Lite 7.7, Keypad 2.9, Keypad Touch 2.9, Keypad Vision 2.5, Keypad Vision Pro 1.0, App 9.18 and later.
• The fixed versions are not confirmed for this CVE and need to be checked against SwitchBot's release notes.

Workaround

Unknown. No vendor-independent workaround is documented. Physical measures alone do not address the Bluetooth risk.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• According to SwitchBot, no compromised locks have been reported.
• VulDB reports no known exploit. The Neodyme write-up describes the attack at a high level.
• EPSS: 0.00089.

Our recommendation

• Identify all SwitchBot locks, keypads and apps in use, including versions.
• Update the lock firmware, keypad firmware and SwitchBot app to the latest vendor versions and verify the result.
• Do not rely on Bluetooth-only access control for sensitive doors until the update is verified.
• Prioritise sites with frequent visitors, shared access or public-facing doors.
• Monitor lock access logs for unexpected unlock events.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Neodyme: CVE-2026-8374 advisory neodyme.io
• Neodyme: Keyless Entry, hacking SwitchBot smart locks neodyme.io
• Vulners: CVE-2026-8374 (CVE record) vulners.com
• VulDB: CVE-2026-8374 vuldb.com
• Strix: CVE-2026-8374 www.strix.ai
• Threatint: CVE-2026-8374 cve.threatint.com
• Mallory: CVE-2026-8374 summary mallory.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:02.