CVE-2022-37418
The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive valid key fob signals over the…
Does this matter?
Lower severity and a low EPSS score (1.00%). Track it; it rarely justifies an emergency change on its own.
Description
The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive valid key fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.
- CVSS 3.1
- 6.4 MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 1.00% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-294
- Affected
- nissan/nissan firmware · kia/kia firmware · hyundai/hyundai firmware
- Source
- cve@mitre.org
References
- https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/Exploit, Third Party Advisory
- https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490Exploit, Third Party Advisory
- https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185Exploit, Third Party Advisory
- https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attackPress/Media Coverage, Third Party Advisory
- https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5tExploit, Third Party Advisory
- https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/Exploit, Third Party Advisory
- https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490Exploit, Third Party Advisory
- https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185Exploit, Third Party Advisory
- https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attackPress/Media Coverage, Third Party Advisory
- https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5tExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.