A vulnerability was found in Nissan/Kia/Hyundai Vehicle up to 2017. It has been declared as very critical. This vulnerability affects an unknown function of the component Remote Keyless Entry. The manipulation with an unknown input leads to a improper authentication vulnerability (RollBack). The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive valid key fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.

The weakness was presented 08/24/2022. The advisory is shared for download at hackaday.com. This vulnerability was named CVE-2022-37418 since 08/05/2022. Technical details are unknown but an exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 09/25/2022). This vulnerability has a historic impact due to its background and reception.

It is declared as proof-of-concept. As 0-day the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Additional details are provided at medium.com.

Productinfo

Vendor

• Hyundai
• Kia
• Nissan

Name

• Vehicle

Version

• 2017

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion