CVE Feed

    Dashboard / CVE / CVE-2026-112345

    CVE-2026-112345

    TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

    Published:Oct 26, 2026
    Last Modified:Oct 30, 2026
    EPS:Oct 26, 2026
    EPSS Score:0.00245
    CVSS Score:8.1

    Affected Products

    Vendor
    Sciener
    Product
    Ttlock App
    Vendor
    Ttlock
    Product
    Ttlock

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High