CVE-2022-36945

Katalog CVE

CVSS 6.4 · Medium EPSS 1,0%

Kerentanan Authentication Bypass by Capture-replay pada mazda firmware. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.

Rincian

Terbit di NVD

24 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 61,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/ exploit · advisory pihak ketiga
• https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entr... exploit · advisory pihak ketiga
• https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-au... exploit · advisory pihak ketiga
• https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attack press/media coverage · advisory pihak ketiga
• https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5t exploit · advisory pihak ketiga