CVE-2026-2540
Replay Attack Vulnerability in Micca KE700 Enables Alarm Key Cloning
Publication date: 2026-02-15
Last updated on: 2026-02-15
Assigner: Automotive Security Research Group (ASRG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| micca | ke700 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-294 | A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes). |
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include enforcing strict anti-replay protections on the Micca KE700 system.
- Maintain a persistent counter state and reject any rolling codes with counter values less than or equal to the last valid code.
- Secure the resynchronization logic to only accept codes ahead of the current counter within a defined window, preventing acceptance of old codes as enabling signals.
These steps prevent the system from accepting stale codes and block the replay attack that allows unauthorized cloning of the alarm key.
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'The Micca KE700 car alarm system has a vulnerability due to flawed resynchronization logic in its receiver. This flaw allows the system to accept previously used (stale) rolling codes, enabling a replay attack known as a RollBack attack.'}, {'type': 'paragraph', 'content': "An attacker captures two signals from the key fob at different times: an older 'enabling' rolling code and a newer 'execution' code. By sending the older code first, the receiver is tricked into an enabled state, allowing it to accept the newer stale code and execute commands such as unlocking or locking the vehicle."}, {'type': 'paragraph', 'content': 'This vulnerability allows cloning of the alarm key and unauthorized access to the vehicle by replaying captured codes multiple times after a single enabling signal.'}] [1]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'Successful exploitation of this vulnerability allows an attacker to clone the alarm key and gain unauthorized access to your vehicle.'}, {'type': 'list_item', 'content': 'The attacker can unlock or lock the vehicle doors without your permission.'}, {'type': 'list_item', 'content': 'Repeated unauthorized access is possible by replaying multiple captured codes after a single enabling signal.'}, {'type': 'paragraph', 'content': "This compromises the security and integrity of your vehicle's alarm system, potentially leading to theft or unauthorized use."}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by capturing and analyzing the radio signals sent by the Micca KE700 key fob to the car alarm system. Tools such as Flipper Zero (in Sub-GHz mode), AutoRFKiller, or Universal Radio Hacker can be used to capture these signals.'}, {'type': 'paragraph', 'content': "Detection involves checking if the system accepts replayed rolling codes, specifically if it accepts an older 'enabling' code followed by a newer 'execution' code that should normally be rejected."}, {'type': 'paragraph', 'content': 'Suggested commands depend on the tool used. For example, with Flipper Zero, you can use its Sub-GHz capture mode to record signals from the key fob and then attempt to replay them to see if the system accepts stale codes.'}, {'type': 'paragraph', 'content': 'Similarly, AutoRFKiller and Universal Radio Hacker can be used to capture, analyze, and replay signals to test for acceptance of previously used codes.'}] [1]