CVE-2025-6030 Details
Description
Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry System, which allows a replay attack. Research was completed on the 2024 KIA Soluto. Attack confirmed on other KIA Models in Ecuador.
A replay attack vulnerability has been identified in the Autoeastern Cyclone Matrix TRF Smart Keyless Entry System, specifically in KIA vehicles in Ecuador for the 2024 and 2025 model years. This vulnerability arises from the use of learning codes in the key fob transmitter, allowing an attacker to capture and replicate the signal used to unlock the car. The issue has been confirmed on other KIA models in Ecuador as well.
Users are advised to replace key fobs using learning codes with ones that utilize rolling codes, a more secure technology that has been available since the 1990s. This vulnerability has been reported to KIA Ecuador, but no remediation has been implemented. The issue is being addressed with the support of the Automotive Security Research Group (ASRG).
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 13, 2025CISA-ADP
Assessed Jun 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://asrg.io/security-advisories/cve-2025-6030-autoeastern-smart-keyless-entry-system-replay-attack/ | [email protected] | AdvisoryExploitRemedy |
| https://revers3everything.com/unlocking-thousands-of-cars-by-exploiting-learning-codes-from-key-fobs/ | [email protected] | ExploitRemedyTechnical Analysis |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Autoeastern Cyclone Matrix TRF | All versions |
CPE
Remediation
| |
| KIA Soluto | All versions |
CPE
Remediation
| |
| KIA Río | All versions |
CPE
Remediation
| |
| KIA Picanto | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 13, 2025 | New CVE Received | [email protected] |