CVE-2024-48548: Cloud Smart Lock Firmware

Critical severity, CVSS 9.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. This vulnerability allows attackers to arbitrarily construct a request to use the app to bind to unknown devices by finding a valid serial number via a bruteforce attack.

Affected products

Published 2024-10-24. Last modified 2026-06-17.