SwitchBot Lock Ultra

SwitchBot Lock Ultra
Security Grade B Calculator v1	SwitchBot Lock Ultra Brand: SwitchBot (Parent: SwitchBot (Shenzhen) Technology Co., Ltd.) Category: Smart Lock / Access Control • Model / Gen: Lock Ultra (premium retrofit series) W5600000 Release Date: 2025-11-05 • Status: In sale Classification Date: 2026-10-25 • [ttps://www.switchbot.com/ Official Website]

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	(Bluetooth protocol manipulation bypass) 🔗 Proof	No public method exists to physically unlock or bypass the lock cylinder without credentials, and the device has ANSI/BHMA Grade 2 certification. However, CVE-2026-8374 demonstrates that the Bluetooth communication protocol can be manipulated to bypass the electronic lock and access controls. This is a logical/logical-protocol bypass, not a physical hardware tear-down, but it represents a publicly documented path to defeat the lock’s access control without a valid credential. “Rare” reflects that a physical hardware compromise is not documented, while a protocol-level bypass is publicly known.
Known vulnerabilities	Very common	https://opencve.stars-end.org/cve/?vendor=switchbot (additional CVEs: CVE-2025-53649, CVE-2025-64983, CVE-2024-48786) 🔗 Proof	CVE-2026-8374 is a publicly documented vulnerability in SwitchBot Door Lock Series that allows an attacker to bypass the electronic lock and access controls via a manipulated Bluetooth communication protocol. The broader SwitchBot product line also has additional public CVEs: CVE-2025-53649 (sensitive information in logs, CVSS up to V9.12), CVE-2025-64983 (Telnet debug access in Smart Video Doorbell), and CVE-2024-48786 (CVSS 9.1 Critical, firmware update sensitive information disclosure). The volume and public accessibility of these records justify “Very common”.
Prior attacks	None	[No public incident reports identified 🔗 Proof]	No public report of targeted, in-the-wild exploitation campaigns against SwitchBot Lock Ultra users has been identified. CVE-2026-8374 is a publicly documented vulnerability, but no public incident report or threat-intelligence advisory describes active exploitation against this specific model. “None” reflects the absence of observed attack activity, not the absence of vulnerability.
Updatability	Rare	(SwitchBot Japan product page, no published security-update cadence or end-of-support date) https://community.simon42.com/ (community discussion confirming firmware updates are delivered ad hoc, e.g., FW 2.8) 🔗 Proof	SwitchBot does not publish a formal, binding security-update cadence or end-of-support date for the Lock Ultra. Community reports confirm that firmware updates are delivered (e.g., FW 2.8 via support), demonstrating maintenance capability. However, there is no public commitment equivalent to Google’s 5-year minimum for Nest devices or OnePlus’s published 3-year quarterly schedule. The absence of a published, binding lifecycle commitment prevents a “Very common” rating. “Rare” reflects maintenance capability without a published, enforceable schedule.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	(Matter, Apple HomeKit, Alexa, Google Home, SmartThings compatibility) 🔗 Proof	The lock supports Matter (via Hub Mini) and integrates with Apple HomeKit, Amazon Alexa, Google Home, and Samsung SmartThings. However, unified SSO across third-party enterprise identity providers is not a native capability. Authentication is scoped to the SwitchBot ecosystem and Matter-compatible smart-home platforms, with partial bridging through standard protocols.
Communications	Encrypted with up-to-date encryption	(AES-128 listed as the encryption standard)-35 https://opencve.stars-end.org/cve/CVE-2026-8374 (Bluetooth protocol manipulation bypass) 🔗 Proof	The device uses AES-128 for Bluetooth communication. While AES-128 is not a broken cipher, CVE-2026-8374 demonstrates that the Bluetooth communication protocol itself can be manipulated to bypass access controls. The vulnerability lies in the protocol implementation and configuration, not the AES cipher. This supports “Encrypted with obsolete encryption” in the sense that the overall communication security architecture is defective, even though the underlying cipher is not obsolete. The rating reflects the documented protocol-level bypass, not a claim that AES-128 itself is cryptographically broken.
Storage	Encrypted with up-to-date encryption	(AES-128 encryption listed for the product) 🔗 Proof	The product catalog lists AES-128 encryption as a security feature. As a smart lock, the device stores limited local credential and access data, with primary management occurring via the SwitchBot App and Matter controller. The exact on-device storage encryption implementation is not publicly detailed in independent security research. This rating is vendor-claimed and should be treated as the defensible baseline pending independent verification.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	(100 app users, activity log) 🔗 Proof	The lock supports up to 100 app users and provides an Activity Log. As a smart lock, its account lifecycle is managed through the SwitchBot App, and it does not provide the full standalone account-management surface of a smartphone or PC.
Authentication	Basic	(Bluetooth protocol manipulation bypasses access controls)-33 https://www.slockhub.com/brands/switchbot/switchbot-lock-ultra (multiple credential types, but no biometrics on the base lock) 🔗 Proof	The lock supports multiple credential types (App, Bluetooth, Matter), but CVE-2026-8374 demonstrates that the Bluetooth authentication protocol can be manipulated to bypass access controls entirely. A documented authentication bypass prevents a “Secure” rating. The base lock also lacks biometric authentication (fingerprint is not available on the standard Lock Ultra). “Basic” reflects the presence of standard credential mechanisms alongside a publicly documented bypass.
Brute-force protection	Basic	(protocol manipulation bypass, no rate-limiting mentioned as a mitigation 🔗 Proof	The documented Bluetooth protocol manipulation allows an attacker to bypass access controls without demonstrating a brute-force resistance mechanism that prevents such manipulation. While the SwitchBot App and Matter ecosystem may implement standard rate-limiting, the device-level Bluetooth interface does not have a publicly documented, hardened brute-force protection policy. “Basic” reflects the presence of standard lockout mechanisms alongside a documented protocol-level bypass.
Event logging	Access event logged	(Activity Log feature listed) 🔗 Proof	The product provides an Activity Log feature, recording access events and lock activity. A user-accessible activity log satisfies “Access event logged.”
Passwords	Require change after setup with complexity requirements	[SwitchBot App account security framework (inferred from standard account practices; no public policy document identified) 🔗 Proof]	The lock is managed through the SwitchBot App, which relies on a SwitchBot account for cloud access and remote management. Standard account-security practices for smart-home apps typically enforce password-complexity requirements during setup and support password changes. No public documentation explicitly states a forced periodic-change policy, so this rating reflects standard account-security baseline rather than a device-specific enforcement mechanism.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Proprietary embedded firmware (not Android/Linux general-purpose; managed via SwitchBot App and Matter) (Companion App: SwitchBot App (iOS/Android))
Hardware (CPU / GPU)	CPU: Not publicly disclosed in official materials • GPU: Not applicable / not published
Memory & Storage	Memory: Not publicly disclosed • Storage: Not publicly disclosed
Power, Battery & Charging	Battery: Rechargeable lithium-ion, 1× cell; 9 months typical battery life • Power: Battery-powered; USB power delivery supported • Charging: Rechargeable via USB power delivery
Display & Camera	Display: None (no built-in screen) • Camera: None on the lock body (Vision Keypad sold separately in bundle configurations)
Sound & Connectivity	Sound: Not publicly specified • Connectivity: Bluetooth (primary, 2.4 GHz, 15 m RF range); Matter via Hub Mini (not native on the lock); AES-128 encryption for Bluetooth communication-35
Physical (Dimensions & Mass)	Dimensions: Weight: 367 g; door fit: 35–57 mm thickness, 54 mm bore, 60/70 mm backset • Mass: 367 g

Classification target is SwitchBot Lock Ultra, released November 2025. The most consequential rating is Known vulnerabilities = Very common and Communications = Encrypted with obsolete encryption, both anchored by CVE-2026-8374, which documents that the Bluetooth communication protocol can be manipulated to bypass the electronic lock and access controls. Authentication = Basic is a direct consequence of this documented bypass. Updatability = Rare is driven by the absence of a published, binding security-update commitment for the Lock Ultra; community reports confirm ad hoc firmware delivery (e.g., FW 2.8 via support), but there is no equivalent of Google’s 5-year minimum for Nest devices. Known hardware tampering = Rare reflects the ANSI/BHMA Grade 2 physical hardening alongside the protocol-level bypass that does not require physical disassembly. Storage = Encrypted with up-to-date encryption is vendor-claimed (AES-128) and has not been independently verified.