Autoeastern Smart Keyless Entry System Replay Attack

published 2025-06-13 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-18278

cvss: 9.4; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 12%
public exploits: 0; none known

Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack.

Research was completed on the 2024 KIA Soluto. Attack confirmed on other KIA Models in Ecuador.

Patch / fix

fixed in 1

Autoeastern Cyclone Matrix TRF L-ALARMATRF-001

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 16 mo ago (2025-06-13)

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.4	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N
CNA	4.0	9.4	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X

Affected products

Autoeastern Cyclone Matrix TRF

Classification

Weakness

CWE-307 Improper Restriction of Excessive Authentication Attempts
CWE-294 Authentication Bypass by Capture-replay

References

Sources

CVE List CVE-2025-6030
NVD CVE-2025-6030

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary