{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/smart-lock-firmware/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-112345"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TTLock Android application (\u003c 9.8.260718)","smart-lock firmware"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["TTLock"],"content_html":"\u003cp\u003eTTLock Android application versions prior to v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key. This vulnerability allows an attacker within Bluetooth range to decrypt the per-pairing session key, recover the persistent session key, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, or perform administrative actions without authentication or user interaction.\u003c/p\u003e\n","date_modified":"2026-10-26T19:44:32Z","date_published":"2026-10-26T19:44:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ttlock-ble-vulnerability/","summary":"TTLock Android applications before v9.8.260718 and associated smart-lock firmware utilize a hardcoded static AES key, allowing an attacker within Bluetooth range to intercept session keys and forge administrative commands.","title":"TTLock: Hardcoded AES key in Android app and smart-lock firmware (CVE-2026-112345)","url":"https://feed.craftedsignal.io/briefs/2026-10-ttlock-ble-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Smart-Lock Firmware","version":"https://jsonfeed.org/version/1.1"}