The vulnerability in igloohome Smart Lock Mobile Application arises from the inclusion of sensitive information in the source code, which permits an unauthenticated actor to invoke backend services that lack adequate authentication controls. The core impact is the potential for an attacker to manipulate or retrieve lock functions without authorization, thereby compromising the confidentiality and integrity of the lock system. The weakness is classified as CWE‑540, highlighting a configuration or deployment error where sensitive data is exposed in code.

igloohome Smart Lock Mobile Application versions 3.2.3 and earlier are susceptible to this issue. Users operating these releases are at risk until they update to the patched version that implements enhanced backend access control mechanisms.

With a CVSS score of 6.9 the vulnerability is of moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA KEV, implying no known active exploitation. The likely attack vector involves an attacker sending crafted requests to backend endpoints that are inadequately protected by authentication; such requests could be triggered remotely if network access is available. The vendor’s solution tightens authentication and authorization on backend services, removing the need for user interaction to mitigate the risk.