motogadget mo.lock Ignition Lock up to 20251125 NFC hard-coded key

Summaryinfo

A vulnerability marked as problematic has been reported in motogadget mo.lock Ignition Lock up to 20251125. Affected by this issue is some unknown functionality of the component NFC Handler. The manipulation leads to hard-coded key. This vulnerability is referenced as CVE-2025-6666. It is possible to launch the attack on the physical device. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in motogadget mo.lock Ignition Lock up to 20251125. This issue affects an unknown code of the component NFC Handler. The manipulation with an unknown input leads to a hard-coded key vulnerability. Using CWE to declare the problem leads to CWE-321. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. Impacted is confidentiality.

The weakness was published by A. E. Graafstra, M. P. Faith and A. C. Buglione. The advisory is shared at office.dngr.us. The identification of this vulnerability is CVE-2025-6666. The exploitation is known to be difficult. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Technical details are unknown but an exploit is available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue. The advisory points out:

An attacker with brief physical proximity can perform a high-speed, non-privileged read of a key’s 7-byte serial number (UID) using standard NFC reading equipment such as a smartphone. Subsequently, an ISO 14443-A emulator such as the Flipper Zero or Proxmark3 can be used to replay the captured UID to any mo.lock NFC unit, systematically iterating through the limited (16-bit) password verification value space to recover the authentication data needed to create a clone of the ignition key.

It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way. The advisory illustrates:

This vulnerability’s root cause is a combination of two critical design flaws. First, the use of a globally shared secret across all units means every mo.lock NFC lock serves as a cryptographic oracle capable of validating authentication attempts for any captured UID. Second, the password verification value space provides insufficient entropy and is trivial to exhaust.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-199909). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• motogadget

Name

• mo.lock Ignition Lock

Version

• 20251125

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #701162: motogadget mo.lock NFC CWE-290, CWE-327, CWE-1394 (by drewbug)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion