EUVD-2026-39417
GHSA-2qp5-r5hx-q27p
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A for mandatory RF proximity; UI:R because capture requires victim to actively transmit key fob signals during attacker presence; I:H for full lock-state integrity violation.
Primary rating from Vendor (ASRG).
CVSS VectorVendor: ASRG
Lifecycle Timeline
2DescriptionCVE.org
Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication.
An attacker within RF range who records two consecutive lock or unlock transmissions from a legitimate key fob can later replay the same pair of transmissions repeatedly. During testing, replaying the first captured transmission caused the RKES to enter a state in which replaying the second captured transmission resulted in a successful lock or unlock operation of the vehicle. Tested and confirmed on a 2024 Suzuki Swift (SWIFT ISG GLS AC 1.2 5P 4x2 TM).
AnalysisAI
Rolling-code authentication in the Alps Alpine RKES (FCC ID CWTR53R0, 433 MHz) can be bypassed by an attacker within RF range who captures two consecutive key fob transmissions and replays them in sequence to lock or unlock the target vehicle. Replaying the first captured signal causes the receiver to enter a vulnerable state, after which replaying the second signal completes a successful unauthorized lock or unlock operation. No active exploitation confirmed per CISA KEV and no public exploit code identified, though the attack is technically accessible to anyone with commodity software-defined radio hardware given CVSS AV:A/AC:L/PR:N.
Technical ContextAI
CWE-294 (Authentication Bypass by Capture-Replay) describes the root cause: a correctly implemented rolling-code scheme (e.g., KeeLoq or similar) advances a synchronized counter on every transmission and the receiver accepts only codes within a forward window, permanently invalidating prior codes. The vulnerability here is a rollback weakness - the RKES receiver apparently re-accepts previously transmitted codes when they arrive in a specific two-packet sequence, suggesting either the resynchronization window logic or the code-invalidation state machine is defective. The hardware is a 433 MHz key fob module manufactured by Alps Alpine Co., Ltd., identified by FCC ID CWTR53R0 (CPE: cpe:2.3:a:alps_electric_co.,_ltd.:remote_keyless_entry_system_(rkes)_r53r0:*:*:*:*:*:*:*:*). The attack was reproduced on a 2024 Suzuki Swift, indicating the flaw resides in the Alps Alpine module rather than vehicle-specific firmware.
RemediationAI
No vendor-released patch has been identified at the time of analysis - remediation of a hardware rolling-code implementation requires either a firmware update to the RKES receiver/transmitter pair (if the module supports it) or physical hardware replacement. Vehicle owners should contact Suzuki and Alps Alpine Co., Ltd. directly for official guidance. As compensating controls: use a Faraday-shielded key fob pouch when not actively operating the vehicle to prevent passive RF interception, noting this does not protect against capture during legitimate use; avoid pressing the key fob in crowded or publicly observable locations where an attacker with an SDR could be present; use the physical key cylinder for locking when in high-risk environments, which generates no RF signal and eliminates exposure. Vehicle manufacturers sourcing this module should engage Alps Alpine for a rolling-code algorithm audit and push a firmware update via dealer service if over-the-air capability is unavailable.
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today