Yadea T5 Electric Bicycles Keyless Entry System authentication replay

Summaryinfo

A vulnerability was found in Yadea T5 Electric Bicycles and classified as critical. The impacted element is an unknown function of the component Keyless Entry System. Executing a manipulation can lead to authentication replay. This vulnerability is handled as CVE-2025-70994. The attack can only be done within the local network. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical was found in Yadea T5 Electric Bicycles (the affected version is unknown). This vulnerability affects an unknown code of the component Keyless Entry System. The manipulation with an unknown input leads to a authentication replay vulnerability. The CWE definition for the vulnerability is CWE-294. A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal forgery after a local attacker intercepts any legitimate key fob transmission, allowing for complete unauthorized vehicle operation via a replay attack.

The advisory is available at github.com. This vulnerability was named CVE-2025-70994 since 01/09/2026. The exploitation appears to be difficult. The attack needs to be initiated within the local network. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 04/23/2026). This vulnerability is assigned to T1040 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-209567). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Yadea

Name

• T5 Electric Bicycles

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion