Are McGrath NX5 smart locks secure? We tested one.

Our answer

We tested it ourselves, on a current-production NX5 we own, and could not open it as a walk-up attacker. We went through the lock's entire command set and tried every published Sciener/TTLock walk-up exploit against the firmware and app versions shipping in September 2026.

• The published challenge brute-force (CVE-2023-7006) no longer works: the challenge is 32-bit, not 16-bit, and you can't even obtain one without an administrator credential.
• The plaintext message weakness (CVE-2023-7009) is still present, but on its own it does not open the door — every command that could reveal or bypass a credential is refused regardless.
• The undocumented "SCIENER" authorisation bypass described in public analysis is not in this firmware.
• The wireless keypad channel (CVE-2023-7003) is reachable without authentication, but the only route from there is guessing the owner's PIN, which the lock throttles with an alarm and a cool-down — we estimate about 50 days of continuous, conspicuous attack. Not practical.
• One pathway we deliberately did not test — the unauthenticated firmware-update path (CVE-2023-7017) — because a failed attempt can permanently disable the lock. We say so in the report rather than guess.

So: no, we could not find a way for a stranger at the door to open an NX5. That is one model, one firmware, one app version, tested with the methods we describe — it is not a guarantee, and it does not cover attacks that need the owner to be using the lock nearby, which are a different conversation and a separate, confidential report to the manufacturer.

The full method, results and limitations are in our published assessment: Analysis of Walk-up Opening Exploits to a McGrath NX5 Digital Lockset. If you want a digital lock fitted, that is what we fit, and it is why we can tell you this from our own bench rather than a brochure.