CVE-2025-6030

Autoeastern Smart Keyless Entry System Replay Attack

State: Published
Severity: 9.4 Critical
Published: Jun 13, 2025
Updated: Jun 13, 2025
Reserved: Jun 12, 2025

Description

Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack.

Research was completed on the 2024 KIA Soluto. Attack confirmed on other KIA Models in Ecuador.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N	ASRG

Weaknesses

CWE-307 Improper Restriction of Excessive Authentication Attempts
CWE-294 Authentication Bypass by Capture-replay

Affected Products

Product	Versions
Cyclone Matrix TRFAutoeastern	2024 through 2025Affectedfrom L-ALARMATRF-001Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.