CVE-2026-2540 describes a replay attack vulnerability in the Micca KE700 system, stemming from flawed resynchronization logic. An attacker can force the system to accept stale rolling codes by sending two previously captured codes in a specific sequence. This allows for the cloning of the alarm key, granting unauthorized access to unlock or lock vehicle doors. The vulnerability has a CVSS score of 8.4 (HIGH), indicating a significant risk. It is a low-complexity attack requiring adjacent network access, with a high impact on integrity and confidentiality. While the EPSS score is low, the potential for unauthorized vehicle access is critical. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Micca Auto Electronics Co., Ltd. | Car Alarm System KE700 | KE700CNA affecteddefault affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:M/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.4 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.