CVE-2025-6029CWE-294CWE-307

KIA-branded Aftermarket Generic Smart Keyless Entry System Replay Attack

Critical · published June 13, 2025

CVSS v4.0
9.4
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyless Entry System, primarily distributed in Ecuador, which allows a replay attack.

Manufacture is unknown at the time of release.  CVE Record will be updated once this is clarified.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N
EPSS
0.00684 · 52.0th percentile
Weaknesses
CWE-294 · Authentication Bypass by Capture-replay; CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-06-13T14:25Z
EPSS history
Timeline
  • 13 JUN 14:25Z
    KIA-branded Aftermarket Generic Smart Keyless Entry System Replay Attack
    cvelistv5