PT-2025-25420 · Unknown · Kia-Branded Aftermarket Generic Smart Keyless Entry System

Danilo Erazo · Published 2025-06-13 · Updated 2025-07-25 · CVE-2025-6029

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N

Name of the Vulnerable Software and Affected Versions KIA-branded Aftermarket Generic Smart Keyless Entry System versions 2022 through 2025

Description The issue is related to the use of fixed learning codes in the Key Fob Transmitter, which allows a replay attack. This affects KIA vehicles in Ecuador, primarily those using outdated key fobs with vulnerable chips. Attackers can exploit this to unlock vehicles remotely. The estimated number of affected devices is not specified.

Recommendations For KIA-branded Aftermarket Generic Smart Keyless Entry System versions 2022 through 2025, consider disabling the keyless entry feature until a patch is available. Restrict access to the key fob transmitter to minimize the risk of exploitation. Avoid using the vulnerable chips HS2240 and EV1527 in the key fobs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-294

Related Identifiers

CVE-2025-6029

Affected Products

Kia-Branded Aftermarket Generic Smart Keyless Entry System

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2025-6029 · Security Note
• https://t.me/latest_high_impact_cve/2648 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1933557498776035380 · Twitter Post
• https://t.me/cvetracker/26195 · Telegram Post
• https://twitter.com/compuchris/status/1948572360933507188 · Twitter Post
• https://t.me/latest_high_impact_cve/2649 · Telegram Post
• https://twitter.com/wvipersg/status/1934595106113306716 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1934430266313109949 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1934623167558857105 · Twitter Post
• https://twitter.com/CVEnew/status/1933538282274521199 · Twitter Post
• https://twitter.com/CveFindCom/status/1933534795683836140 · Twitter Post
• https://twitter.com/Komodosec/status/1947673806644121637 · Twitter Post
• https://twitter.com/offseq/status/1933721160895647758 · Twitter Post
• https://twitter.com/freedomhack101/status/1934957929863827580 · Twitter Post
• https://asrg.io/security-advisories/cve-2025-6029-kia-branded-aftermarket-generic-smart-keyless-entry-system-replay-attack · Note