CVE-2026-2541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2541", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "state": "PUBLISHED", "assignerShortName": "ASRG", "dateReserved": "2026-02-15T10:49:23.973Z", "datePublished": "2026-02-15T11:07:40.539Z", "dateUpdated": "2026-02-17T17:06:46.968Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Car Alarm System KE700", "vendor": "Micca Auto Electronics Co., Ltd.", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Danilo Erazo"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low entropy allows an attacker to perform a brute-force attack against one component of the rolling code. Successful exploitation simplify an attacker to predict the next valid rolling code, granting unauthorized access to the vehicle."}], "value": "The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low entropy allows an attacker to perform a brute-force attack against one component of the rolling code. Successful exploitation simplify an attacker to predict the next valid rolling code, granting unauthorized access to the vehicle."}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112: Brute Force"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "baseScore": 6.4, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:H/V:D/RE:H", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "HIGH"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-331", "description": "CWE-331: Insufficient Entropy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-02-15T11:07:40.539Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://asrg.io/security-advisories/cve-2026-2541/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul><li><b>Increase entropy:</b> The random component of the code must be significantly larger. A 16-bit keyspace is insecure by modern standards. A minimum of 64 bits of entropy would make a brute-force attack computationally infeasible.</li>\n</ul>"}], "value": "* Increase entropy: The random component of the code must be significantly larger. A 16-bit keyspace is insecure by modern standards. A minimum of 64 bits of entropy would make a brute-force attack computationally infeasible."}], "source": {"discovery": "EXTERNAL"}, "title": "Micca KE700 Brute-force vulnerability due to low entropy", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-17T16:42:16.545829Z", "id": "CVE-2026-2541", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T17:06:46.968Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2541", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-17T16:42:16.545829Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-17T16:42:17.228Z"}}], "cna": {"title": "Micca KE700 Brute-force vulnerability due to low entropy", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Danilo Erazo"}], "impacts": [{"capecId": "CAPEC-112", "descriptions": [{"lang": "en", "value": "CAPEC-112: Brute Force"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.4, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:H/V:D/RE:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Micca Auto Electronics Co., Ltd.", "product": "Car Alarm System KE700", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "* Increase entropy: The random component of the code must be significantly larger. A 16-bit keyspace is insecure by modern standards. A minimum of 64 bits of entropy would make a brute-force attack computationally infeasible.", "supportingMedia": [{"type": "text/html", "value": "<ul><li><b>Increase entropy:</b> The random component of the code must be significantly larger. A 16-bit keyspace is insecure by modern standards. A minimum of 64 bits of entropy would make a brute-force attack computationally infeasible.</li>\n</ul>", "base64": false}]}], "references": [{"url": "https://asrg.io/security-advisories/cve-2026-2541/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low entropy allows an attacker to perform a brute-force attack against one component of the rolling code. Successful exploitation simplify an attacker to predict the next valid rolling code, granting unauthorized access to the vehicle.", "supportingMedia": [{"type": "text/html", "value": "The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low entropy allows an attacker to perform a brute-force attack against one component of the rolling code. Successful exploitation simplify an attacker to predict the next valid rolling code, granting unauthorized access to the vehicle.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-331", "description": "CWE-331: Insufficient Entropy"}]}], "providerMetadata": {"orgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "shortName": "ASRG", "dateUpdated": "2026-02-15T11:07:40.539Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2541", "state": "PUBLISHED", "dateUpdated": "2026-02-17T17:06:46.968Z", "dateReserved": "2026-02-15T10:49:23.973Z", "assignerOrgId": "c15abc07-96a9-4d11-a503-5d621bfe42ba", "datePublished": "2026-02-15T11:07:40.539Z", "assignerShortName": "ASRG"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "Car Alarm System KE700", "vendor": "Micca Auto Electronics Co., Ltd.", "versions": [{"status": "affected", "version": "KE700"}, {"status": "unknown", "version": "KE700+"}]}], "source": "cve@asrg.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing only 64 possible combinations. This low entropy allows an attacker to perform a brute-force attack against one component of the rolling code. Successful exploitation simplify an attacker to predict the next valid rolling code, granting unauthorized access to the vehicle."}, {"lang": "es", "value": "El sistema Micca KE700 se basa en una porci\u00f3n de 6 bits de un identificador para la autenticaci\u00f3n dentro de c\u00f3digos rotatorios, lo que proporciona solo 64 combinaciones posibles. Esta baja entrop\u00eda permite a un atacante realizar un ataque de fuerza bruta contra un componente del c\u00f3digo rotatorio. La explotaci\u00f3n exitosa simplifica a un atacante predecir el siguiente c\u00f3digo rotatorio v\u00e1lido, lo que otorga acceso no autorizado al veh\u00edculo."}], "id": "CVE-2026-2541", "lastModified": "2026-06-17T10:31:16.630", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:H/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "HIGH"}, "source": "cve@asrg.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2541", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-17T16:42:16.545829Z", "version": "2.0.3"}}]}, "published": "2026-02-15T11:15:55.223", "references": [{"source": "cve@asrg.io", "url": "https://asrg.io/security-advisories/cve-2026-2541/"}], "sourceIdentifier": "cve@asrg.io", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-331"}], "source": "cve@asrg.io", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "KE700"}}], "product": "car_alarm_system_ke700", "vendor": "micca_auto_electronics"}], "analysis": {"en": {"generated_at": "2026-04-17T19:20:34.114326+00:00", "value": {"mitigation_remediation": ["Update the KE700 firmware or configuration so that the rolling code\u2019s random component uses at least a 64\u2011bit keyspace, eliminating the low\u2011entropy weakness.", "Re\u2011configure the system to enforce the new 64\u2011bit rolling code and disable any legacy 6\u2011bit code generation paths.", "Add an additional authentication factor\u2014such as a keypad entry or biometric verification\u2014if firmware changes are not yet available, to reduce reliance on the compromised rolling code mechanism."], "summary": {"action": "Apply Fix", "impact": "Authentication bypass via brute\u2011force on rolling code"}, "threat_synthesis": {"affected_systems": "All Micca Auto Electronics\u2019 Car Alarm System KE700 units are affected. The vulnerability applies to every deployment of the KE700 product; no specific firmware or hardware revision information was provided.", "description_and_impact": "A 6\u2011bit portion of the Micca KE700 alarm system\u2019s rolling code is used for authentication. Because only 64 combinations are available, an attacker can brute\u2011force this component quickly and predict the next valid code. This allows an unauthorized user to gain entry to the vehicle, effectively bypassing the intended security mechanism. The weakness exemplifies insufficient entropy, classified as CWE\u2011331.", "risk_and_exploitability": "The CVSS base score is 6.4, indicating a moderate impact. The EPSS score is below 1\u202f%, suggesting that exploitation is unlikely under normal circumstances, but the simplicity of the attack (requiring only a brute\u2011force on a 6\u2011bit field) means a determined adversary can repeat the process rapidly. The vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. The attack path is inferred to involve access to the vehicle\u2019s signaling interface or a similar channel where the rolling code is transmitted, allowing an attacker to capture or guess the 6\u2011bit code easily."}}}}, "created": "2026-02-16T09:43:05.357336+00:00", "updated": "2026-04-17T19:30:15.634794+00:00", "vendors": ["micca_auto_electronics", "micca_auto_electronics$PRODUCT$car_alarm_system_ke700"]}