« Volver al listado

CVE-2026-8374

Estado: AplazadaAlta (8.5)—

El mal uso y la configuración incorrecta en la comunicación Bluetooth en SwitchBot Door Lock Series permite a un atacante eludir el cierre electrónico y los controles de acceso mediante un protocolo de comunicación manipulado.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L sin UI:R e impacto en VI:H/VA:H. La manipulación de protocolo Bluetooth para eludir candados electrónicos logra escalada de privilegios y acceso físico no autorizado.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionUpdate SoftwareUser TrainingUser Account ManagementThreat Intelligence ProgramRestrict Web-Based Content

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Switchbot — Door Lock SeriesAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-8374",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8374",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-10-15T17:57:54.302937Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
        "cvssData": {
          "Safety": "PRESENT",
          "version": "4.0",
          "Recovery": "IRRECOVERABLE",
          "baseScore": 8.5,
          "Automatable": "NO",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:I/V:D/RE:H/U:Red",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "RED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "HIGH",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
      "affectedData": [
        {
          "vendor": "SwitchBot",
          "modules": [
            "Bluetooth communication"
          ],
          "product": "Lock Series Lock",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "3.4"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SwitchBot",
          "modules": [
            "Bluetooth communication"
          ],
          "product": "Lock Series Keypad",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.7"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SwitchBot",
          "modules": [
            "Bluetooth communication"
          ],
          "product": "Lock Series App",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "9.2.6"
            }
          ],
          "platforms": [
            "Android"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-10-09T13:17:11.240",
  "references": [
    {
      "url": "https://neodyme.io/en/advisories/cve-2026-8374/",
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674"
    },
    {
      "url": "https://neodyme.io/en/blog/switchbot/",
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "a341c0d1-ebf7-493f-a84e-38cf86618674",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1204"
        },
        {
          "lang": "en",
          "value": "CWE-1240"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol."
    }
  ],
  "lastModified": "2026-10-15T19:17:48.117",
  "sourceIdentifier": "a341c0d1-ebf7-493f-a84e-38cf86618674"
}