CVE-2026-112345— TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

Quick assessment

Affected

Sciener TTLock

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

TTLock Android 应用程序在版本 v9.8.260718 之前，以及配套的智能锁固件中，存在一个硬编码的静态 AES 密钥漏洞。该漏洞允许处于蓝牙通信范围内的攻击者解密在 BLE（蓝牙低功耗）配对过程中传输的每对设备会话密钥。攻击者可以窃听配对交互过程，利用内置的默认密钥（defaultKey）恢复持久化会话密钥，进而伪造经过身份验证的 BLE 请求，在无需任何身份验证或用户交互的情况下执行解锁设备、添加指纹或密码、以及执行管理操作等恶意行为。

CVSS 8.1 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1055 · Process Injection T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure

Source: CVE Program / CVE List V5

Vulnerability Description

TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用硬编码的密码学密钥

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Sciener	TTLock	0 ~ 9.8.260718	-

II. Public POCs for CVE-2026-112345

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-112345

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-112345 (1)

🔗 TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure | Advisories | VulnCheck third-party-advisory

Security Blog Posts for CVE-2026-112345 (1)

🔗 Insecure Cryptographic Key-Sharing Protocol in TTLock Bluetooth Pairing | Damiri.fr technical-description exploit

https://www.cve.org/CVERecord?id=CVE-2026-112345

IV. Related Vulnerabilities

Same vendor: Sciener

Same weakness: CWE-321