CVE-2022-36945
The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a…
Does this matter?
Lower severity and a low EPSS score (1.00%). Track it; it rarely justifies an emergency change on its own.
Description
The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.
- CVSS 3.1
- 6.4 MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 1.00% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-294
- Affected
- mazda/mazda firmware
- Source
- cve@mitre.org
References
- https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/Exploit, Third Party Advisory
- https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490Exploit, Third Party Advisory
- https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185Exploit, Third Party Advisory
- https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attackPress/Media Coverage, Third Party Advisory
- https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5tExploit, Third Party Advisory
- https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/Exploit, Third Party Advisory
- https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490Exploit, Third Party Advisory
- https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185Exploit, Third Party Advisory
- https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attackPress/Media Coverage, Third Party Advisory
- https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5tExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.