CVE-2022-37305
The Remote Keyless Entry (RKE) receiving unit on certain Honda vehicles through 2018 allows remote attackers to perform unlock operations and force a resynchronization after capturing five consecutive valid RKE signals over the radio, aka a RollBack…
Does this matter?
Lower severity and a low EPSS score (1.00%). Track it; it rarely justifies an emergency change on its own.
Description
The Remote Keyless Entry (RKE) receiving unit on certain Honda vehicles through 2018 allows remote attackers to perform unlock operations and force a resynchronization after capturing five consecutive valid RKE signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.
- CVSS 3.1
- 6.4 MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 1.00% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-294
- Affected
- honda/honda firmware
- Source
- cve@mitre.org
References
- https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/Exploit, Third Party Advisory
- https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490Exploit, Third Party Advisory
- https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185Exploit, Third Party Advisory
- https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attackPress/Media Coverage, Third Party Advisory
- https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5tExploit, Third Party Advisory
- https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/Exploit, Third Party Advisory
- https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490Exploit, Third Party Advisory
- https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185Exploit, Third Party Advisory
- https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attackPress/Media Coverage, Third Party Advisory
- https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5tExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.