The Tinxy WiFi Lock Controller v1 RF is configured to operate on an open Wi-Fi network, which permits attackers to connect without any authentication. This lack of access control can lead to unauthorized access to the device, compromising confidentiality and integrity. The vulnerability is identified as CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 9.1, reflecting critical severity. There is no information about patches or vendor advisories, and no known exploits have been reported in the wild as of the publication date.

An attacker can join the open Wi-Fi network used by the Tinxy WiFi Lock Controller v1 RF without authentication, potentially gaining unauthorized access to the device. This can lead to a complete compromise of confidentiality and integrity of the device's operations. Availability impact is not indicated. The critical CVSS score reflects the high risk of unauthorized control or data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict network access by isolating the device on a secured network segment or disabling the open Wi-Fi configuration if possible. Monitor for vendor updates regarding official patches or configuration changes to enforce authentication.