CVE-2025-6030CWE-294CWE-307

Autoeastern Smart Keyless Entry System Replay Attack

Critical · published June 13, 2025

CVSS v4.0
9.4
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack.

Research was completed on the 2024 KIA Soluto.  Attack confirmed on other KIA Models in Ecuador.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N
EPSS
0.00221 · 12.0th percentile
Weaknesses
CWE-294 · Authentication Bypass by Capture-replay; CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2025-06-13T14:38Z
EPSS history
Timeline
  • 13 JUN 14:38Z
    Autoeastern Smart Keyless Entry System Replay Attack
    cvelistv5