SwitchBot Lock Pro Flaw Enabled Silent Bluetooth Unlocking Without Secret Keys

Researchers at Neodyme demonstrated a Bluetooth-proximity attack against SwitchBot Lock Pro smart locks that could silently unlock doors without disassembly, physical tampering, or knowledge of the secret key. The flaw arose from AES-CTR encryption without message integrity protection, allowing attackers to modify an intercepted LOCK command into an UNLOCK command using a reusable difference vector. Encryption alone therefore did not prevent unauthorized changes to security-critical commands.

SwitchBot’s initial firmware fix added a two-byte verification tag, but researchers bypassed it because the lock actuator still accepted untagged smartphone commands. SwitchBot subsequently updated its ecosystem, and researchers confirmed on April 2, 2026, that the described attack no longer worked against the updated version. The report also identified key-fob cloning and magnetic tamper-alarm bypass risks. Organizations using these locks should check deployed firmware and companion apps against the fixed versions listed in Neodyme’s advisory and assess the additional physical-access risks separately from the patched Bluetooth attack.