CVE-2025-6030

Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack. Research was completed on the 2024 KIA Soluto. Attack confirmed on other KIA Models in Ecuador.

CVSS

No CVSS.

References

Link	Resource
https://asrg.io/security-advisories/cve-2025-6030-autoeastern-smart-keyless-entry-system-replay-attack/
https://revers3everything.com/unlocking-thousands-of-cars-by-exploiting-learning-codes-from-key-fobs/

Configurations

No configuration.

History

16 Jun 2025, 12:32

Type	Values Removed	Values Added
Summary		(es) Uso de códigos de aprendizaje fijos, uno para bloquear el vehículo y otro para desbloquearlo, en el transmisor de llavero del sistema de entrada sin llave inteligente Cyclone Matrix TRF, lo que permite un ataque repetido. Se realizó una investigación en el KIA Soluto 2024. Se confirmó el ataque en otros modelos de KIA en Ecuador.

13 Jun 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-13 15:15

Updated : 2025-06-16 12:32

NVD link : CVE-2025-6030

Mitre link : CVE-2025-6030

CVE.ORG link : CVE-2025-6030

JSON object : View

Products Affected

No product.

CWE

CWE-294

Authentication Bypass by Capture-replay

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2025-6030", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "cve@asrg.io", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NO", "attackVector": "ADJACENT", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-06-13T15:15:21.600", "references": [{"url": "https://asrg.io/security-advisories/cve-2025-6030-autoeastern-smart-keyless-entry-system-replay-attack/", "source": "cve@asrg.io"}, {"url": "https://revers3everything.com/unlocking-thousands-of-cars-by-exploiting-learning-codes-from-key-fobs/", "source": "cve@asrg.io"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@asrg.io", "description": [{"lang": "en", "value": "CWE-294"}, {"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the\u00a0Key Fob Transmitter in Cyclone Matrix TRF\u00a0Smart Keyless Entry System, which allows a replay attack.\n\nResearch was completed on the 2024 KIA Soluto.\u00a0 Attack confirmed on other KIA Models in Ecuador."}, {"lang": "es", "value": "Uso de c\u00f3digos de aprendizaje fijos, uno para bloquear el veh\u00edculo y otro para desbloquearlo, en el transmisor de llavero del sistema de entrada sin llave inteligente Cyclone Matrix TRF, lo que permite un ataque repetido. Se realiz\u00f3 una investigaci\u00f3n en el KIA Soluto 2024. Se confirm\u00f3 el ataque en otros modelos de KIA en Ecuador."}], "lastModified": "2025-06-16T12:32:18.840", "sourceIdentifier": "cve@asrg.io"}