The igloohome Smart Lock Mobile Application up to version 3.2.3 contains sensitive information embedded in its source code. This exposure could enable unauthorized users to reach functions or backend services that do not have adequate authentication protections. The vulnerability is identified as CWE-540 and has a CVSS 3.1 base score of 5.3, reflecting a network exploitable issue with low attack complexity and no privileges or user interaction needed. As of the published date, no vendor advisory or patch is available, and no known exploits have been reported in the wild.

An attacker could leverage the exposed sensitive information in the source code to access backend services or functions without proper authentication. This could lead to unauthorized access to certain application features or backend components, potentially compromising confidentiality. The CVSS vector indicates no impact on integrity or availability, and the overall impact is limited to information disclosure and unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigation steps are provided by the vendor at this time.