CVE-2026-2540

Katalog CVE

CVSS 8.4 · High EPSS 0,22%

Kerentanan Authentication Bypass Using an Alternate Path or Channel. Skor CVSS 4.0 8.4 (High) menurut asrg.io.

Deskripsi (NVD)

The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors.

Rincian

Terbit di NVD

15 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 4.0

8.4 (High), sumber asrg.io
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:M/U:X · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-288: Authentication Bypass Using an Alternate Path or Channel
CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 11,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://asrg.io/security-advisories/cve-2026-2540/