SwitchBot Security Bulletins
To continuously improve the security of our products, we publish and update security notices to keep you informed of newly identified security vulnerabilities, affected versions, and available remediations, helping you stay up to date on the security status of our products.
| Internal ID | Vulnerability Details | CVSS | Severity | Publication Date | Acknowledgements | notes |
|---|---|---|---|---|---|---|
| ORSA-2026-001 | Description and Impact: Within Bluetooth range of the device, an unauthenticated user may use specific BLE commands to place the nRF52832 into Nordic Legacy DFU mode. Insufficient firmware verification may allow unintended firmware to be installed, potentially affecting device functionality or preventing the device from operating normally. Affected Product: SwitchBot Hub Mini Affected Version: BLE firmware V68 Remediation: The new firmware closes the BLE command entry point to DFU mode and includes the necessary App-side changes to block this update path. Fixed Version: V69-55Fix Fixed Date: August 14, 2026 | CVSS 3.1：8.1 | High | 20-Sep-26 | Sungbin Mo (gl4ss), HEXA LABS by CROCUS | |
| ORSA-2026-002 | Description and Impact: Earlier firmware used AES-CTR encryption without sufficient integrity protection and could reuse encryption nonces. Under certain conditions, an attacker within Bluetooth range could potentially modify a valid command, which may affect lock operation. Affected Products and Versions: 1.Lock: SwitchBot Lock: ＜V7.7 SwitchBot Lock Pro: ＜V3.7 SwitchBot Lock WiFi: ＜V15.21 SwitchBot Lock Ultra: ＜V2.8 SwitchBot Lock Lite: ＜V7.7 2.Keypad: SwitchBot Keypad: ＜V2.9 SwitchBot Keypad Touch: ＜V2.9 SwitchBot Keypad Vision: ＜V2.5 SwitchBot Keypad Vision Pro: ＜V1.0 3.App: SwitchBot App: ＜V9.18 Remediation: The Bluetooth protocol has been upgraded to AES-GCM. Each encryption uses a unique nonce, and the authentication tag is verified before the lock executes a command. These changes improve system security. Fixed Versions: 1.Lock:SwitchBot Lock: V7.7 and later SwitchBot Lock Pro: V3.7 and later SwitchBot Lock WiFi: V15.21 and later SwitchBot Lock Ultra: V2.8 and later SwitchBot Lock Lite: V7.7 and later 2.Keypad: SwitchBot Keypad: V2.9 and later SwitchBot Keypad Touch: V2.9 and later SwitchBot Keypad Vision: V2.5 and later SwitchBot Keypad Vision Pro: V1.0 and later 3.App: SwitchBot App: V9.18 and later Fixed Date: November 6, 2026 | CVSS 4.0：8.5 | High | 06-Nov-26 | Aaron Kaiser (Neodyme AG)Tobias Madl (Neodyme AG)Justin Mietzner (Neodyme AG)JPCERT | CVE-2026-8374 |