CVE-2017-17435

An issue was discovered in the software on Vaultek Gun Safe VT20i products, aka BlueSteal. An attacker can remotely unlock any safe in this product line without a valid PIN code. Even though the phone application requires it and there is a field to supply the PIN code in an authorization request, the safe does not check the PIN code, so an attacker can obtain authorization using any value. Once an attacker sees the Bluetooth Low Energy (BLE) advertisement for the safe, they need only to write a BLE characteristic to enable notifications, and send a crafted getAuthor packet that returns a temporary key, and an unlock packet including that temporary key. The safe then opens after the unlock packet is processed, with no verification of PIN or other credentials.

• CWE-287

• https://vaulteksafe.com/index.php/cve-2017-17435/Vendor Advisory
• https://www.twosixlabs.com/bluesteal-popping-gatt-safes/Third Party Advisory
• https://vaulteksafe.com/index.php/cve-2017-17435/Vendor Advisory
• https://www.twosixlabs.com/bluesteal-popping-gatt-safes/Third Party Advisory

Published

Dec 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1743IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 coul…
• CVE-2017-17430Sangoma NetBorder / Vega Session Controller before 2.3.12-80…
• CVE-2017-17431GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, …
• CVE-2017-17432OpenAFS 1.x before 1.6.22 does not properly validate Rx ack …
• CVE-2017-17433The recv_files function in receiver.c in the daemon in rsync…
• CVE-2017-17434The daemon in rsync 3.1.2, and 3.1.3-development before 2017…
• CVE-2017-17436An issue was discovered in the software on Vaultek Gun Safe …
• CVE-2017-17439In Heimdal through 7.4, remote unauthenticated attackers are…
• CVE-2017-17440GNU Libextractor 1.6 allows remote attackers to cause a deni…
• CVE-2017-17442In BlackBerry UEM Management Console version 12.7.1 and earl…
• CVE-2017-17443OPC Foundation Local Discovery Server (LDS) 1.03.370 require…
• CVE-2017-17446The Mem_File_Reader::read_avail function in Data_Reader.cpp …