Advisories › igloohome › ICSA-26-209-06
igloohome Smart Lock Mobile Application: 1 CVE, Medium 5.3
Summary
CISA reports 1 vulnerability in igloohome Smart Lock Mobile Application (Android). Weakness type: Inclusion of Sensitive Information in Source Code. Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. Highest CVSS v3 score: 5.3 (Medium), exploitable over the network.
What to do: Plan: igloohome have enhanced the access control mechanisms on backend services to ensure that only properly authenticated and authorized requests can interact with sensitive functionality. No user interaction is needed.
At a glance
- Vendor
- igloohome
- Products
- Smart Lock Mobile Application (Android)
- CVEs
- CVE-2026-16581
- Highest CVSS v3
- 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Commercial Facilities
- Deployed
- Worldwide
- Vendor HQ
- Singapore
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-16581 | Inclusion of Sensitive Information in Source Code | 5.3 | – | No | In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls. |
Affected products (1)
- igloohome Smart Lock Mobile Application (Android): 3.2.3
Vendor fixes and mitigations (from advisory)
- Vendor Fix: igloohome have enhanced the access control mechanisms on backend services to ensure that only properly authenticated and authorized requests can interact with sensitive functionality. No user interaction is needed.
- Mitigation: For more information, contact igloohome (info@igloohome.com). link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.