CVE-2026-112345: TTLock Android App < 9.8.260718 Hardcoded BLE Pairing Key Exposure
Sciener · TTLock
Vendor fix available · Affected: Sciener TTLock · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 15% of scored CVEs
DescriptionCVE.org
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Sciener · TTLockbefore 9.8.260718
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- Sciener
- Published
- October 2026
CoverageNo articles yet
No CyberSIXT article names CVE-2026-112345 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.