EUVD-2025-209567
GHSA-4cpv-8qgx-f9fv
Severity by source
AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
RF-proximity attack (AV:A) needing a captured fob press (UI:R) but no auth (PR:N); yields full vehicle control (I:H/A:H) with no data disclosure (C:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal forgery after a local attacker intercepts any legitimate key fob transmission, allowing for complete unauthorized vehicle operation via a replay attack.
AnalysisAI
Replay-based keyless entry bypass in Yadea T5 electric bicycles (2024 and later model years) lets a nearby attacker clone the RF signal from the key fob and take full control of the vehicle. Because the fob uses the EV1527 fixed-code protocol with no rolling codes or challenge-response, a single captured transmission can be rebroadcast to unlock and operate the bike. Publicly available exploit code exists (two GitHub repositories), though EPSS is very low (0.03%) and it is not listed in CISA KEV.
Technical ContextAI
The flaw lives in the RF keyless-entry subsystem, which relies on the EV1527 encoder - a widely used, low-cost, learning-code (fixed-code) OOK/ASK protocol common in cheap garage remotes, gate openers, and consumer alarms. EV1527 transmits a static 20-bit device ID plus a 4-bit command with no counter, timestamp, or cryptographic session, so every valid button press yields an identical, reusable frame. This maps to CWE-1390 (Weak Authentication): the system authenticates the fob purely by a replayable static code rather than a cryptographic secret, meaning capture-and-replay fully defeats it. The CPE data is unhelpful here (placeholder cpe:2.3:a:n/a:n/a:*), so affected-product scoping comes from the description rather than structured NVD CPE.
RemediationAI
No vendor-released patch identified at time of analysis, and because the weakness is in the fixed-code RF design, a firmware update alone likely cannot fix it - remediation realistically requires the manufacturer to replace the fob/receiver with a rolling-code or cryptographic challenge-response system, so owners should monitor Yadea for a hardware recall or upgraded key-fob kit. As compensating controls: use a secondary physical lock (U-lock/chain) so RF replay alone cannot move or steal the bike; store and use the fob inside an RF-shielding (Faraday) pouch to reduce opportunistic signal capture, accepting the trade-off that you must remove it to use keyless entry; and where the model supports it, disable or avoid the passive keyless-entry feature in favor of a physical key or PIN, trading convenience for security. Track the NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-70994) and VulDB (https://vuldb.com/vuln/359146) entries for an official fix.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-1390 – Weak Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today