{"id":"CVE-2025-6030","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-6030","generatedAt":"2026-10-28T03:26:53.372Z","title":"Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack.","description":"Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart  Keyless Entry System, which allows a replay attack.\n\nResearch was completed on the 2024 KIA Soluto.  Attack confirmed on other KIA Models in Ecuador.","published":"2025-06-13T15:15:22.000Z","lastModified":"2026-06-17T10:01:02.000Z","status":"Deferred","sourceIdentifier":"cve@asrg.io","cvss":{"version":"4.0","score":9.4,"severity":"CRITICAL","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-294","CWE-307"],"affected":[],"epss":{"score":0.00221,"percentile":0.12596,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.22%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://asrg.io/security-advisories/cve-2025-6030-autoeastern-smart-keyless-entry-system-replay-attack/","source":"cve@asrg.io"},{"url":"https://revers3everything.com/unlocking-thousands-of-cars-by-exploiting-learning-codes-from-key-fobs/","source":"cve@asrg.io"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-6030","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}