CVE-2026-2540

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2540", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "state": "PUBLISHED", "assignerShortName": "ASRG", "dateReserved": "2026-02-15T10:49:22.820Z", "datePublished": "2026-02-15T11:03:26.051Z", "dateUpdated": "2026-02-17T17:06:53.980Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Car Alarm System KE700", "vendor": "Micca Auto Electronics Co., Ltd.", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Danilo Erazo"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors."}], "value": "The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors."}], "impacts": [{"capecId": "CAPEC-395", "descriptions": [{"lang": "en", "value": "CAPEC-395: Bypassing Electronic Locks and Access Controls"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 8.4, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:H/V:D/RE:M", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-294", "description": "CWE-294: Authentication Bypass by Capture-replay", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-02-15T11:03:26.051Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://asrg.io/security-advisories/cve-2026-2540/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul><li><b>Enforce strict anti-replay</b>: The receiver must maintain a persistent state (e.g., the counter value of the last valid code). It must never accept a code with a counter value less than or equal to the last known valid counter.</li>\n<li><b>Secure resynchronization logic</b>: The logic triggered by an old code is the flaw and must be removed. Secure resynchronization should only be triggered by codes that are ahead of the current counter to allow a \"drifted\" key fob to re-sync.</li>\n</ul>"}], "value": "* Enforce strict anti-replay: The receiver must maintain a persistent state (e.g., the counter value of the last valid code). It must never accept a code with a counter value less than or equal to the last known valid counter.\n\n * Secure resynchronization logic: The logic triggered by an old code is the flaw and must be removed. Secure resynchronization should only be triggered by codes that are ahead of the current counter to allow a \"drifted\" key fob to re-sync."}], "source": {"discovery": "EXTERNAL"}, "title": "Micca KE700 Acceptance of previously used rolling codes", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T16:42:17.825107Z", "id": "CVE-2026-2540", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T17:06:53.980Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2540", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T16:42:17.825107Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:42:18.480Z"}}], "cna": {"title": "Micca KE700 Acceptance of previously used rolling codes", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Danilo Erazo"}], "impacts": [{"capecId": "CAPEC-395", "descriptions": [{"lang": "en", "value": "CAPEC-395: Bypassing Electronic Locks and Access Controls"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:H/V:D/RE:M", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "MODERATE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Micca Auto Electronics Co., Ltd.", "product": "Car Alarm System KE700", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "* Enforce strict anti-replay: The receiver must maintain a persistent state (e.g., the counter value of the last valid code). It must never accept a code with a counter value less than or equal to the last known valid counter.\n\n * Secure resynchronization logic: The logic triggered by an old code is the flaw and must be removed. Secure resynchronization should only be triggered by codes that are ahead of the current counter to allow a \"drifted\" key fob to re-sync.", "supportingMedia": [{"type": "text/html", "value": "<ul><li><b>Enforce strict anti-replay</b>: The receiver must maintain a persistent state (e.g., the counter value of the last valid code). It must never accept a code with a counter value less than or equal to the last known valid counter.</li>\n<li><b>Secure resynchronization logic</b>: The logic triggered by an old code is the flaw and must be removed. Secure resynchronization should only be triggered by codes that are ahead of the current counter to allow a \"drifted\" key fob to re-sync.</li>\n</ul>", "base64": false}]}], "references": [{"url": "https://asrg.io/security-advisories/cve-2026-2540/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors.", "supportingMedia": [{"type": "text/html", "value": "The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "CWE-294: Authentication Bypass by Capture-replay"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-02-15T11:03:26.051Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2540", "state": "PUBLISHED", "dateUpdated": "2026-02-17T17:06:53.980Z", "dateReserved": "2026-02-15T10:49:22.820Z", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "datePublished": "2026-02-15T11:03:26.051Z", "assignerShortName": "ASRG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Car Alarm System KE700", "vendor": "Micca Auto Electronics Co., Ltd.", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}]}], "source": "cve@asrg.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors."}, {"lang": "es", "value": "El sistema Micca KE700 contiene l\u00f3gica de resincronizaci\u00f3n defectuosa y es vulnerable a ataques de repetici\u00f3n. Este ataque requiere el env\u00edo de dos c\u00f3digos previamente capturados en una secuencia espec\u00edfica. Como resultado, el sistema puede ser forzado a aceptar c\u00f3digos rotatorios previamente usados (obsoletos) y ejecutar un comando. La explotaci\u00f3n exitosa permite a un atacante clonar la llave de la alarma. Esto otorga al atacante acceso no autorizado al veh\u00edculo para desbloquear o bloquear las puertas."}], "id": "CVE-2026-2540", "lastModified": "2026-06-17T10:31:16.510", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:M/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "cve@asrg.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2540", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T16:42:17.825107Z", "version": "2.0.3"}}]}, "published": "2026-02-15T11:15:55.070", "references": [{"source": "cve@asrg.io", "url": "https://asrg.io/security-advisories/cve-2026-2540/"}], "sourceIdentifier": "cve@asrg.io", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}, {"lang": "en", "value": "CWE-294"}], "source": "cve@asrg.io", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "KE700"}}], "product": "car_alarm_system_ke700", "vendor": "micca_auto_electronics"}], "analysis": {"en": {"generated_at": "2026-04-18T12:11:32.457467+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2019s firmware update that enforces a persistent counter state for received rolling codes and rejects any code whose counter value is less than or equal to the last known valid counter.", "Configure the system so that resynchronization logic is only triggered by codes with counter values ahead of the current counter, eliminating the flaw that allows resynchronization on older codes.", "If possible, disable or limit the resynchronization feature until the update is fully deployed to prevent accidental acceptance of replayed codes."], "summary": {"action": "Patch Now", "impact": "Unauthorized vehicle access"}, "threat_synthesis": {"affected_systems": "Vendor Micca Auto Electronics Co., Ltd. produces the Car Alarm System KE700 that is affected. No specific product versions are listed, so all implementations of this model should be considered vulnerable.", "description_and_impact": "The Micca KE700 alarm system suffers from flawed resynchronization logic that permits replay attacks, an authentication failure (CWE\u2011288) caused by insufficient anti\u2011replay protection and a missing replay detection (CWE\u2011294). By transmitting two previously captured rolling codes in a specific order, an attacker can trick the receiver into accepting a stale code, effectively cloning the alarm key. The cloned key then grants unauthorized control to unlock or lock the vehicle, representing a significant escalation of privileges.", "risk_and_exploitability": "The CVSS score of 8.4 indicates a high severity vulnerability. EPSS < 1% suggests a low probability of exploitation so far, and the vulnerability is not listed in the CISA KEV catalog, implying no widespread public exploitation reports. Based on the description, it is inferred that the attacker must capture two valid rolling codes\u2014likely through physical proximity or signal interception\u2014before carrying out the replay sequence. Once the replay succeeds, the system grants access that was never intended for the attacker."}}}}, "created": "2026-02-16T09:43:06.651282+00:00", "updated": "2026-04-18T12:15:15.785023+00:00", "vendors": ["micca_auto_electronics", "micca_auto_electronics$PRODUCT$car_alarm_system_ke700"]}