PT-2022-23985 · Hyundai+2 · Hyundai+2

Levente Csikor · Published 2022-08-24 · Updated 2022-08-31 · CVE-2022-37418

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nissan, Kia, and Hyundai vehicles (affected versions not specified)

Description The issue allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive valid key fob signals over the radio. This enables the attacker to retain the ability to unlock the vehicle indefinitely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2022-37418

Affected Products

Hyundai

Kia

Nissan

References · 7

• 🔥 https://blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185 · Exploit
• 🔥 https://youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5t · Exploit
• 🔥 https://hackaday.com/2022/08/17/rollback-breaks-into-your-car · Exploit
• 🔥 https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490 · Exploit
• https://osv.dev/vulnerability/CVE-2022-37418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37418 · Security Note
• https://pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attack · Note