Skip to content

Product

Sciener TTLock App vulnerabilities

4 published CVES affecting Sciener TTLock App, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
4
Critical
0
High
2
Medium
2
Low
0
Unscored
0
CISA KEV
0

Latest Sciener TTLock App CVEs

Newest publication first

  1. CVE-2023-7005 CVE-2023-7005

    Published
    HighCVSS 7.5 EPSS 0.26%

    A specially crafted message can be sent to the TTLock App that downgrades the encryption protocol used for communication, and can be utilized to compromise the lock, such as through revealing the unlockKey field.

  2. CVE-2023-6960 CVE-2023-6960

    Published
    HighCVSS 7.5 EPSS 0.25%

    TTLock App virtual keys and settings are only deleted client side, and if preserved, can access the lock after intended deletion.

  3. CVE-2023-7003 CVE-2023-7003

    Published
    MediumCVSS 6.8 EPSS 0.28%

    The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other locks using the Sciener firmware.

  4. CVE-2023-7004 CVE-2023-7004

    Published
    MediumCVSS 6.5 EPSS 0.17%

    The TTLock App does not employ proper verification procedures to ensure that it is communicating with the expected device, allowing for connection to a device that spoofs the MAC address of a lock, which compromises the legitimate locks integrity.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.