Keyless Entry: Hacking SwitchBot Smart Locks
Summary
Neodyme reports multiple vulnerabilities in SwitchBot Lock Pro smart locks, including a cryptographic flaw in BLE that enables software-only unlocks without physical tampering. The post details the reverse engineering process, the attack workflow (setup and attack phases), responsible disclosure, and the patch timeline, highlighting IoT security pitfalls for SMB IT, security teams, and product developers. A CVE was published in October 2026 and fixed versions for Lock, Keypad, and App are listed.