Threats tagged 'ghsa-cr86-mm6w-6p6g'

The TTLock Android application versions before 9.8.260718 and associated smart-lock firmware contain a vulnerability due to a hardcoded static AES key. This flaw allows attackers within Bluetooth range to decrypt the per-pairing session key during BLE pairing. Exploitation enables unauthorized actions such as unlocking the device, adding fingerprints or access codes, and performing administrative tasks without user authentication or interaction.