igloohome Smart Lock Mobile Application
View CSAF Summary Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services. The following versions of igloohome Smart Lock Mobile Application are affected: Smart Lock Mobile Application (Android) 3.2.3 (CVE-2026-16581) CVSS Vendor Equipment Vulnerabilities v3 5.3 igloohome igloohome Smart Lock Mobile Application Inclusion of Sensitive Information in Source Code Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: Singapore Vulnerabilities Expand All + CVE-2026-16581 In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls. View CVE Details Affected Products igloohome Smart Lock Mobile Application Vendor: igloohome Product Version: igloohome Smart Lock Mobile Application (Android): 3.2.3 Product Status: known_affected Remediations Vendor fix igloohome have enhanced the access control mechanisms on backend services to ensure that only properly authenticated and authorized requests can interact with sensitive functionality. No user interaction is needed. Mitigation For more information, contact igloohome (info@igloohome.com). mailto:info@igloohome.com Relevant CWE: CWE-540 Inclusion of Sensitive Information in Source Code Metrics CVSS Version Base Score Base Severity Vector String 3.1 5.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 4.0 6.9 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Acknowledgments Vincent C. of CodeVispera reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users t
CSIRTS triage
- What
- A vulnerability could allow unauthorized access to functions or backend services.
- Who is affected
- Users of the igloohome Smart Lock Mobile Application versions 3.2.3 and prior.
- Urgency
- Remediation is critical as exploitation could lead to unauthorized access.
- Action
- Users should update to a version later than 3.2.3.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Smart Lock Mobile Application
Get an email when a new Smart Lock Mobile Application advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-06
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-165810.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-16581 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
Recent advisories for igloohome Smart Lock
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
More from CISA Cybersecurity Advisories
- unknownMitsubishi Electric CC-Link IE TSN Communication Protocol2026-07-30
- criticalSchneider Electric IGSS2026-07-30
- criticalToptech Systems RCU II+ and Multiload II+2026-07-30
- criticalNASA Core Flight System (cFS) Health & Safety (HS) Application2026-07-30
- criticalOpen Source Software: Security Principles and Practices2026-07-30