CVE-2026-2539

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2539", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "state": "PUBLISHED", "assignerShortName": "ASRG", "dateReserved": "2026-02-15T10:49:21.601Z", "datePublished": "2026-02-15T10:58:38.397Z", "dateUpdated": "2026-02-17T17:07:03.354Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "modules": ["RF Communication Module"], "platforms": ["Hardware"], "product": "Car Alarm System KE700", "vendor": "Micca Auto Electronics Co., Ltd.", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Danilo Erazo"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can capture the random number and counters&nbsp;transmitted in cleartext, which is sensitive information required for authentication.</p>"}], "value": "The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can capture the random number and counters\u00a0transmitted in cleartext, which is sensitive information required for authentication."}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37: Retrieve Embedded Sensitive Data"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 5.7, "baseSeverity": "MEDIUM", "exploitMaturity": "PROOF_OF_CONCEPT", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/AU:N/V:D/RE:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "HIGH"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319: Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-02-15T10:58:38.397Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://asrg.io/security-advisories/cve-2026-2539-micca-ke700-cleartext-transmission-of-key-fob-id/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul><li><b>Implement encryption</b>: The entire transmission frame must be encrypted using a standard, proven symmetric algorithm (e.g., AES-128).&nbsp;</li>\n<li><b>Authenticate the frame</b>: The encrypted payload should include a Message Authentication Code (MAC) to prevent tampering or spoofing.</li>\n</ul>"}], "value": "* Implement encryption: The entire transmission frame must be encrypted using a standard, proven symmetric algorithm (e.g., AES-128).\u00a0\n\n * Authenticate the frame: The encrypted payload should include a Message Authentication Code (MAC) to prevent tampering or spoofing."}], "source": {"discovery": "EXTERNAL"}, "title": "Micca KE700 Cleartext transmission of key fob ID", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T16:42:19.132639Z", "id": "CVE-2026-2539", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T17:07:03.354Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T16:42:19.132639Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:42:19.777Z"}}], "cna": {"title": "Micca KE700 Cleartext transmission of key fob ID", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Danilo Erazo"}], "impacts": [{"capecId": "CAPEC-37", "descriptions": [{"lang": "en", "value": "CAPEC-37: Retrieve Embedded Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NO", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/AU:N/V:D/RE:H", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Micca Auto Electronics Co., Ltd.", "modules": ["RF Communication Module"], "product": "Car Alarm System KE700", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}], "platforms": ["Hardware"], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "* Implement encryption: The entire transmission frame must be encrypted using a standard, proven symmetric algorithm (e.g., AES-128).\u00a0\n\n * Authenticate the frame: The encrypted payload should include a Message Authentication Code (MAC) to prevent tampering or spoofing.", "supportingMedia": [{"type": "text/html", "value": "<ul><li><b>Implement encryption</b>: The entire transmission frame must be encrypted using a standard, proven symmetric algorithm (e.g., AES-128).&nbsp;</li>\n<li><b>Authenticate the frame</b>: The encrypted payload should include a Message Authentication Code (MAC) to prevent tampering or spoofing.</li>\n</ul>", "base64": false}]}], "references": [{"url": "https://asrg.io/security-advisories/cve-2026-2539-micca-ke700-cleartext-transmission-of-key-fob-id/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can capture the random number and counters\u00a0transmitted in cleartext, which is sensitive information required for authentication.", "supportingMedia": [{"type": "text/html", "value": "<p>The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can capture the random number and counters&nbsp;transmitted in cleartext, which is sensitive information required for authentication.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319: Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-02-15T10:58:38.397Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2539", "state": "PUBLISHED", "dateUpdated": "2026-02-17T17:07:03.354Z", "dateReserved": "2026-02-15T10:49:21.601Z", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "datePublished": "2026-02-15T10:58:38.397Z", "assignerShortName": "ASRG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "modules": ["RF Communication Module"], "platforms": ["Hardware"], "product": "Car Alarm System KE700", "vendor": "Micca Auto Electronics Co., Ltd.", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}]}], "source": "cve@asrg.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a radio interception tool (e.g., SDR) can capture the random number and counters\u00a0transmitted in cleartext, which is sensitive information required for authentication."}, {"lang": "es", "value": "El protocolo de comunicaci\u00f3n RF en el sistema de alarma de coche Micca KE700 no cifra sus tramas de datos. Un atacante con una herramienta de intercepci\u00f3n de radio (p. ej., SDR) puede capturar el n\u00famero aleatorio y los contadores transmitidos en texto claro, lo cual es informaci\u00f3n sensible necesaria para la autenticaci\u00f3n."}], "id": "CVE-2026-2539", "lastModified": "2026-06-17T10:31:16.400", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NO", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:X/V:D/RE:H/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "HIGH"}, "source": "cve@asrg.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2539", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T16:42:19.132639Z", "version": "2.0.3"}}]}, "published": "2026-02-15T11:15:54.897", "references": [{"source": "cve@asrg.io", "url": "https://asrg.io/security-advisories/cve-2026-2539-micca-ke700-cleartext-transmission-of-key-fob-id/"}], "sourceIdentifier": "cve@asrg.io", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "cve@asrg.io", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["hardware"], "status": "affected", "versions": {"scheme": "generic", "value": "KE700"}}], "product": "car_alarm_system_ke700", "vendor": "micca_auto_electronics"}], "analysis": {"en": {"generated_at": "2026-04-18T12:11:50.589208+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011issued patch that encrypts all RF data frames to protect authentication information.", "Ensure that the patched system includes a message authentication code in each encrypted frame to prevent tampering or replay attacks.", "Verify the correct implementation of encryption and MAC by auditing the RF traffic after the patch."], "summary": {"action": "Apply Patch", "impact": "Confidentiality breach of authentication credentials via cleartext RF transmission"}, "threat_synthesis": {"affected_systems": "Micca Auto Electronics Co., Ltd. Car Alarm System KE700. No specific affected firmware or firmware revision is listed in the advisory, indicating that the flaw may exist in all builds that use the unencrypted RF protocol.", "description_and_impact": "The Micca KE700 car alarm system transmits authentication data over RF without encryption, allowing an attacker to capture the random number and counters used for key fob authentication in cleartext. This disclosure enables the attacker to gain knowledge of the authentication material used by the system, compromising the integrity of the access control mechanism and potentially facilitating unauthorized vehicle entry.", "risk_and_exploitability": "The vulnerability has a CVSS score of 5.7, which indicates a medium impact. The EPSS score of less than 1% implies very low but non\u2011zero likelihood of exploitation. It is not listed in the CISA KEV catalog, suggesting no widespread active exploitation has been reported. The likely attack vector is a remote wireless signal interception using a software defined radio or other RF capture device. An attacker would need only the ability to listen to the KE700 traffic and could obtain the sensitive authentication numbers without any local physical access to the vehicle."}}}}, "created": "2026-02-16T09:43:08.073751+00:00", "updated": "2026-04-18T12:15:15.785657+00:00", "vendors": ["micca_auto_electronics", "micca_auto_electronics$PRODUCT$car_alarm_system_ke700"]}