CVE-2026-112345

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recov...

CVE-2026-112345 TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recov...

EUVD-2026-109945

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recov...

CVE-2026-112345

The T틀ock Android application (prior to version v9.8.260718 ) and its associated smart-lock firmware are vulnerable to a hardcoded static AES key issue (CWE-321). An attacker within Bluetooth range can observe the BLE pairing exchange and use the embedded defaultKey to decrypt the per-pairing ses...

CVE-2019-12942

TTLock devices do not properly block guest access in certain situations where the network connection to the cloud is unavailable...

EUVD-2019-4519

Malware in sbrugna...

EUVD-2019-4518

Malware in sbrugna...

CVE-2019-12943

TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information about valid account names...

CVE-2023-7005

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

CVE-2023-7005 CVE-2023-7005

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

CVE-2023-7005 CVE-2023-7005

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

CVE-2023-7005

The TTLock App (version 6.4.5) and locks utilizing Sciener firmware (such as the Kontrol Lux lock , firmware 6.5.x to 6.5.07) are vulnerable to an encryption downgrade attack. A specially crafted message can be sent to the app to downgrade the communication encryption protocol. During the challen...

CVE-2023-7005: Undefined Security Weakness

A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field...

TTLock security vulnerability

TTLock is a smart lock application from TTLock, Inc. A security vulnerability exists in TTLock that stems from a cryptographic protocol that can be used to compromise a lock by compromising the unlockKey field to degrade the cryptographic protocol used for communication...

CVE-2023-6960

TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion...

CVE-2023-7004

The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity...

CVE-2023-6960 CVE-2023-6960

TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion...

CVE-2023-6960

The TTLock App and electronic locks utilizing Sciener firmware are vulnerable to a flaw where virtual keys and settings are only deleted on the client side. Because the corresponding key information persists within the associated lock even after the intended deletion, an attacker who acquires one...

CVE-2023-6960 CVE-2023-6960

TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion...

CVE-2023-7004

The TTLock App lacks proper verification procedures to ensure it is communicating with the intended device. This allows a threat actor to use a device that spoofs the MAC address of a lock to establish a connection, leading to a compromise of the unlockKey value and overall lock integrity. This v...