Read the docs
TI-2023-06397 Aliases CVE-2023-6998GHSA-cxq4-8ff4-35jm

Lockscreen bypass in eWeLink App

Priority LOW 33CWE-305Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0.

Why it matters now

EPSS 0.00238 14th percentileScored 2026-11-07
Fix Fixed eWeLink - Smart Home (CoolKit Technology): 5.2.0eWeLink-Smart Home (CoolKit Technology): 5.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CoolKit TechnologyeWeLink - Smart Homebefore 5.2.05.2.0Patch availableCNA
CoolKit TechnologyeWeLink-Smart Homebefore 5.2.05.2.0Patch availableCNA
  • eWeLink - Smart Home VendorCoolKit Technology Affected before 5.2.0 Fixed in 5.2.0 Patch available CNA
  • eWeLink-Smart Home VendorCoolKit Technology Affected before 5.2.0 Fixed in 5.2.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:coolkit:ewelink:*:*:*:*:*:android:*:*before 5.2.0VulnerableCoolKIt
cpe:2.3:a:coolkit:ewelink:*:*:*:*:*:iphone_os:*:*before 5.2.0VulnerableCoolKIt
  • cpe:2.3:a:coolkit:ewelink:*:*:*:*:*:android:*:* Versions before 5.2.0 Vulnerable ·CoolKIt
  • cpe:2.3:a:coolkit:ewelink:*:*:*:*:*:iphone_os:*:* Versions before 5.2.0 Vulnerable ·CoolKIt

Remediation

  • Fix · CNA eWeLink - Smart Home (CoolKit Technology) Fixed in 5.2.0
  • Fix · CNA eWeLink-Smart Home (CoolKit Technology) Fixed in 5.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6998
  2. 2026-10-03 Alias added: GHSA-cxq4-8ff4-35jm

References

Advisory 2

Other 1

  • TI-2021-09269 Unconstrained Web access to the device's private encryption key in the QR code pairing… CVSS 3.1MEDIUM 4.6
  • TI-2020-10100 Weak encryption in the Quick Pairing mode in the eWeLink mobile application (Android… CVSS 3.1MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences