CISA flags igloohome smart lock app for embedded credentials
The vulnerable Android app exposes backend authentication data in source code, and igloohome's fix is server-side only, leaving it unclear whether organizations running older app builds remain exposed.
TL;DR
CISA published an advisory for igloohome Smart Lock Mobile App (Android 3.2.3 and prior) containing sensitive information in source code that could let an unauthenticated attacker reach backend services. The vendor says it hardened access controls on the server side and that no user interaction is needed. But the advisory doesn't say whether a patched app build exists, when one shipped, or what users still on 3.2.3 should upgrade to. Organizations managing igloohome locks across commercial facilities should confirm with the vendor directly.
CVE-2026-16581, reported by Vincent C. of CodeVispera, carries a CVSS 3.1 score of 5.3 (Medium). The weakness is CWE-540 (inclusion of sensitive information in source code) which in a mobile app context typically means credentials, keys, or tokens baked into the binary that shouldn't be there. The advisory says exploitation could allow "access to functions or backend services that were not sufficiently protected by authentication controls."
That's a bigger problem than a 5.3 might suggest. When backend authentication data lives in the app itself, anyone who extracts it can talk to the services that operate locks, not by picking a single lock, but through whatever the backend exposes. The CVSS vector reflects a confidentiality impact only (C:L, I:N, A:N), but the advisory's own language about accessing "functions" points to a broader operational concern.
What igloohome did
The vendor's remediation is entirely server-side: "enhanced the access control mechanisms on backend services to ensure that only properly authenticated and authorized requests can interact with sensitive functionality." No user interaction needed, according to the advisory. That's consistent with rotating or locking down whatever credentials were exposed.
What the advisory doesn't say: whether igloohome released a new Android app build that removes the embedded sensitive data, what version number that would be, or when it became available. Organizations that sideloaded the app or manage devices through MDM may still be running 3.2.3 without a clear upgrade target.
CISA lists commercial facilities as the affected critical infrastructure sector and Singapore as igloohome's headquarters location. The advisory says no known public exploitation has been reported to CISA. Organizations with igloohome deployments should contact the vendor at info@igloohome.com for confirmation that their specific installations are covered by the server-side fix.
Published ·Deep Fathom