by Kastro
Paper/Archive/CVE-2025-6029

CVE-2025-6029

KIA Aftermarket Generic Smart Keyless Entry System — KIA-branded Aftermarket Generic Smart Keyless Entry System Replay Attack

EPSS 0.7%CVSS 9.4
critical.is priorityof 100
39
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 52.6.526 × 2010.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyless Entry System, primarily distributed in Ecuador, which allows a replay attack. Manufacture is unknown at the time of release.  CVE Record will be updated once this is clarified.

Affected

ProductAffectedFixed inSource
Aftermarket Generic Smart Keyless Entry SystemKIA Ecuador Key Fobs version 2022/2023–CNA

Scores by source

ASRG (CNA)9.4CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refrevers3everything.com/unlocking-thousands-of-cars-by-exploiting-learning-codes-from-key-fobswriteupasrg.io/security-advisories/cve-2025-6029-kia-branded-aftermarket-generic-smart-keyless-entry-system-replay-attack