Idan Strovinsky

**Name of the Vulnerable Software and Affected Versions** Sciener locks (affected versions not specified) **Description** The firmware update mechanism of the locks does not authenticate or validate firmware updates when they are passed through the Bluetooth Low Energy service. An attacker can send a challenge request with a command to prepare for an update, rather than an unlock request, which allows the attacker to compromise the device. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TTLock App (affected versions not specified) **Description** The TTLock App has an issue where virtual keys and settings are only deleted on the client side. If these deleted items are preserved, they can still be used to access the lock after the intended deletion. This affects electronic locks that utilize firmware provided by Sciener, which works in tandem with the TTLock app. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TTLock App (affected versions not specified) **Description** The issue arises from the TTLock App's failure to properly verify the device it is communicating with, allowing a device that spoofs the MAC address of a lock to connect and compromise the lock's integrity. This affects electronic locks that utilize firmware provided by Sciener, which works in tandem with the TTLock app. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Sciener firmware (affected versions not specified) **Description** The issue concerns the unlockKey character in locks using Sciener firmware, which can be compromised through brute force attacks by sending repeated challenge requests. This affects the integrity of the locks. The firmware is used in electronic locks, such as Kontrol and Elock locks, and works with the TTLock app. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.