The TTLock Android application, deployed on devices before version 9.8.260718, contains a hardcoded, static AES key. The key allows an attacker within Bluetooth range to decrypt the one‑time session key sent during BLE pairing. Using the recovered key, the attacker can forge authenticated BLE requests and unlock the physical lock, add new fingerprints or access codes, and perform other admin actions without user interaction. This vulnerability is a classic example of CWE‑321, which concerns hardcoded cryptographic keys.

Affected systems are the TTLock Android app versions earlier than 9.8.260718 and the corresponding smart‑lock firmware that relies on the same embedded key. The vendor is Sciener, and the product is TTLock. Devices running the legacy app and firmware are susceptible; newer versions are presumed patched.

The CVSS base score of 8.6 indicates a high severity that can compromise confidentiality and integrity of lock access. EPSS is not available for this vulnerability, but the risk remains significant because the attack requires only proximity and does not require credentials or privileged network access. It is not listed in CISA’s KEV catalog, so no publicly known exploitation is reported yet, but the potential for exploitation is substantial. Attackers can execute the exploit over normal Bluetooth pairings, making the asset vulnerable as it is actively in use.