{"id":1668,"date":"2026-08-18T18:00:00","date_gmt":"2026-08-18T18:00:00","guid":{"rendered":"https:\/\/netguide.io\/news\/2026\/08\/18\/midea-portasplit-controllable-via-bluetooth-without-pin\/"},"modified":"2026-09-04T13:24:27","modified_gmt":"2026-09-04T13:24:27","slug":"midea-portasplit-controllable-via-bluetooth-without-pin","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/en\/2026\/08\/18\/midea-portasplit-controllable-via-bluetooth-without-pin\/","title":{"rendered":"Midea PortaSplit: Controllable via Bluetooth Without a PIN"},"content":{"rendered":"<div id=\"netgu-2669934288\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p class=\"wp-block-paragraph\"><strong>According to a report by heise online, the Midea PortaSplit mobile air conditioner can be controlled by third parties via Bluetooth without any authentication. An attacker within radio range can switch the unit on and off, toggle between cooling and heating, and change the temperature \u2013 bypassing the PIN and pairing the app normally requires.<\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How the flaw works<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The problem lies in Midea&#8217;s OEM Bluetooth SDK, which does not verify a device PIN. The control commands are AES-encrypted, but the matching keys can be calculated from information the device itself broadcasts over Bluetooth. This lets an attacker craft valid commands and take over the unit.<\/p><div id=\"netgu-1037836216\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/orico-bluetooth-lautsprecher-bg01-farbenfroh-fuer-1609e\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/b0gyqztlt6-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">ORICO Bluetooth Lautsprecher BG01 \u2013 Farbenfroh f\u00fcr 16,09\u20ac<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">16.09 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>40.00 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-60%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t40\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/shoot-em-up-clive-owen\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/1200x675-1-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Shoot \u2018Em Up | Clive Owen<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">3.99 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>9.99 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-60%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t38\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ai-the-somnium-files-fuer-nintendo-switch-nor-370e\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2835571_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">AI: THE SOMNIUM FILES f\u00fcr Nintendo Switch | NOR 3,70\u20ac<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">3.70 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>19.99 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-81%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t32\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/the-elder-scrolls-v-skyrim-anniversary-edition-fuer-nintendo-switch\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2834768_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">The Elder Scrolls V: Skyrim Anniversary Edition f\u00fcr Nintendo Switch<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">20.00 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>37.00 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-46%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t31\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/hitman-blood-money-reprisal-fuer-nintendo-switch\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2835591_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Hitman: Blood Money \u2013 Reprisal f\u00fcr Nintendo Switch<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">12.49 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>24.99 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-50%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t31\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Important: local only, no internet access<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For context: the vulnerability is limited to the Bluetooth range of around ten metres. Remote control over the internet or the cloud is explicitly <strong>not<\/strong> possible. An attacker would therefore have to be in the immediate vicinity of the device \u2013 for example in the neighbouring flat or outside the window.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Discovery and Midea&#8217;s response<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An anonymous whistleblower reported the issue to heise in mid-August 2026; the editorial team confirmed it using a proof-of-concept app and Python scripts. Midea was initially dismissive but later acknowledged the flaw and, according to the company, is working on an OTA firmware update currently in its testing and validation phase. According to the report, all PortaSplit devices appear to be affected; no CVE has been assigned so far.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What affected owners can do now<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Until a patch is available, the Bluetooth function can be disabled \u2013 though this limits the smart features. If you use the PortaSplit day to day, you will find more on operation and care in our <a href=\"https:\/\/netguide.io\/de\/blog\/midea-portasplit-faq-tipps\/\" target=\"_blank\" rel=\"noopener\">Midea PortaSplit FAQ<\/a>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Source: <a href=\"https:\/\/www.heise.de\/hintergrund\/Mobile-Klimaanlage-Midea-PortaSplit-laesst-sich-von-jedermann-fernsteuern-11417163.html\" target=\"_blank\" rel=\"noopener\">heise online<\/a>.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>The Midea PortaSplit on Amazon:<\/em><\/p>\n\n\n\n<div class=\"atkp-container atkp-box-box  atkp-template-box\">\n                        <div class=\"atkp-box atkp-clearfix atkp-smallbox \"\n                 style=\"\">\n                <div class=\"atkp-predicateheadline atkp-predicate-highlight\">\n                    <span><\/span><\/div>\n                <div class=\"atkp-thumb\">\n                                            <img decoding=\"async\" class=\"atkp-image\" src=\"https:\/\/netguide.io\/news\/?a_image=1&amp;pid=1960&amp;lid=0&amp;sid=1164&amp;name=aHR0cHM6Ly9tLm1lZGlhLWFtYXpvbi5jb20vaW1hZ2VzL0kvMzFFZjQ2dmxQNUwuX1NMMTYwXy5qcGc%3D&amp;key=5d39fd174f8429aa95289bddb103462ea27a44bfe7dbeafc50c72279eaebf833\"\n                             alt=\"Midea Portasplit Mobile W&auml;rmepumpe, Klimaanlage, K&uuml;hlen A++\/Heizen A+, 12000 BTU 3, 5kW, f&uuml;r R&auml;ume bis zu 42 m&sup2; \/ 105 m&sup3;, nur 39 dB(A) im Silent-Modus\"\/>\n                                                                    <div class=\"atkp-rating\"><span class=\"atkp-star atkp-star-0 atkp-star-00\" title=\"0.00 of 5 stars\"><\/span><\/div>\n                                                                                    <div class=\"atkp-reviews\">Show customer reviews<\/div>\n                                                                                        <\/div>\n                <div class=\"atkp-content\">\n                                            <a class=\"atkp-title\" href=\"https:\/\/www.amazon.de\/dp\/B0D3PP64JS?tag=netguideio-21&linkCode=ogi&th=1&psc=1\" rel=\"sponsored nofollow noopener\" target=\"_blank\" onclick=\"_paq.push(['trackEvent', 'affiliate-toolkit Link', 'Link (box, Amazon.de)', ' (Midea PortaSplit: Controllable via Bluetooth Without a PIN)']);\" title=\"Buy now at Amazon.de\">Midea Portasplit Mobile W&auml;rmepumpe, Klimaanlage, K&uuml;hlen A++\/Heizen A+, 12000 BTU 3, 5kW, f&uuml;r R&auml;ume bis zu 42 m&sup2; \/ 105 m&sup3;, nur 39 dB(A) im Silent-Modus*<\/a>\n                                        <div class=\"atkp-author\">by Midea<\/div>\n                                            <div class=\"atkp-shoplogo\">Amazon.de<\/div>\n                                    <\/div>\n                <div class=\"atkp-bottom\">\n                                            <span class=\"atkp-price atkp-listprice\"><\/span>\n                                                                <span class=\"atkp-price atkp-savedamount\"><\/span>\n                                                                <span class=\"atkp-price atkp-saleprice\">\n                            &nbsp;Price not available\n                                                            <span class=\"atkp_price atkp-baseprice\"><\/span>\n                                                    <\/span>\n                                                                <a href=\"https:\/\/www.amazon.de\/dp\/B0D3PP64JS?tag=netguideio-21&linkCode=ogi&th=1&psc=1\" rel=\"sponsored nofollow noopener\" target=\"_blank\" onclick=\"_paq.push(['trackEvent', 'affiliate-toolkit Link', 'Link (box, Amazon.de)', ' (Midea PortaSplit: Controllable via Bluetooth Without a PIN)']);\" title=\"Buy now at Amazon.de\" class=\"atkp-button\">Buy now at Amazon*<\/a>\n                                                                                    <span class=\"atkp-priceinfo\">Price incl. VAT., Excl. Shipping<\/span>\n                                    <\/div>\n            <\/div>\n        \n            <\/div>\n<div id=\"netgu-2481205806\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>According to heise, the Midea PortaSplit can be controlled via Bluetooth without authentication \u2013 from about 10 metres. A firmware update is in the works.<\/p>\n","protected":false},"author":1,"featured_media":1665,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-1668","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=1668"}],"version-history":[{"count":2,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1668\/revisions"}],"predecessor-version":[{"id":2493,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/1668\/revisions\/2493"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1665"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=1668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=1668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=1668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}