CVE-2022-37418

Katalog CVE

CVSS 6.4 · Medium EPSS 1,0%

Kerentanan Authentication Bypass by Capture-replay pada nissan firmware, kia firmware +1 lainnya. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive valid key fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.

Rincian

Terbit di NVD

24 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 61,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/ exploit · advisory pihak ketiga
• https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entr... exploit · advisory pihak ketiga
• https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-au... exploit · advisory pihak ketiga
• https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attack press/media coverage · advisory pihak ketiga
• https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5t exploit · advisory pihak ketiga