CVE-2022-27254

The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626.

CVSS v3 5.3 MEDIUM
CVSS v2.0 2.9 LOW

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

2.9^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 5.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing	Exploit Third Party Advisory
https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty	Exploit Third Party Advisory
https://github.com/nonamecoder/CVE-2022-27254	Exploit Third Party Advisory
https://news.ycombinator.com/item?id=30804702	Exploit Issue Tracking Third Party Advisory
https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/	Exploit Third Party Advisory
https://www.theregister.com/2022/03/25/honda_civic_hack/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:honda:civic_2018_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honda:civic_2018:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-23 22:15

Updated : 2024-02-28 19:09

NVD link : CVE-2022-27254

Mitre link : CVE-2022-27254

CVE.ORG link : CVE-2022-27254

JSON object : View

Products Affected

honda

civic_2018_firmware
civic_2018

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2022-27254", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.9, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2022-03-23T22:15:13.417", "references": [{"url": "https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/nonamecoder/CVE-2022-27254", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://news.ycombinator.com/item?id=30804702", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.theregister.com/2022/03/25/honda_civic_hack/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626."}, {"lang": "es", "value": "El sistema remoto sin llave de los veh\u00edculos Honda Civic 2018, env\u00eda la misma se\u00f1al de RF para cada petici\u00f3n de apertura de puerta, lo que permite un ataque de repetici\u00f3n, un problema relacionado con CVE-2019-20626"}], "lastModified": "2022-03-31T20:28:03.723", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:honda:civic_2018_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "436E1126-02B1-4D50-8C4A-CEAE93DDE521"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:honda:civic_2018:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "91C4C589-8D9C-4EA0-B1E0-BBC699775071"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}