Encryption Protocol Downgrade Vulnerability in TTLock App from TTLock Inc.

CVE-2023-7005

What is CVE-2023-7005?

CVE-2023-7005 describes a security vulnerability in the TTLock App by TTLock Inc., wherein an attacker can send a specially crafted message to successfully downgrade the encryption protocol employed for secure communication. This misconfiguration could enable potential malicious actors to compromise the associated smart lock device, revealing critical information such as the unlockKey field, thus posing a significant risk to user security and privacy.

References