vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-37418

MEDIUM
6.4
CVSS Score
Published: August 24, 2022 at 05:09 AM UTC
Updated: June 17, 2026 at 04:55 AM UTC
6 products affected across 3 vendorsNissan FirmwareKia FirmwareHyundai Firmware

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.4
Exploit prediction
EPSS 0.9%

Description

The Remote Keyless Entry (RKE) receiving unit on certain Nissan, Kia, and Hyundai vehicles through 2017 allows remote attackers to perform unlock operations and force a resynchronization after capturing two consecutive valid key fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Hyundai Firmware· Hyundai
95%
v ≤ 2017
hyundai-hyundai (same device)
Kia Firmware· Kia
95%
v ≤ 2017
kia-kia (same device)
Nissan Firmware· Nissan
95%
v ≤ 2017
nissan-nissan (same device)
Hyundai· Hyundaidevice
80%
All versions
Kia· Kiadevice
80%
All versions
Nissan· Nissandevice
80%
All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (5)

x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://hackaday.com/2022/08/17/rollback-breaks-into-your-car/
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://medium.com/codex/rollback-a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-df5f99ba9490
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.blackhat.com/us-22/briefings/schedule/#rollback---a-new-time-agnostic-replay-attack-against-the-automotive-remote-keyless-entry-systems-27185
x_refsource_MISCPress/Media CoverageThird Party Advisory
Source: [email protected]
https://www.pcmag.com/news/is-your-car-key-fob-vulnerable-to-this-simple-replay-attack
x_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://www.youtube.com/playlist?list=PLYodcy84oQL1gxwiuRm13xRXxTQL9cO5t

CVSS

6.4MEDIUM[email protected]
Attack Vector
ADJACENT_NETWORK
Complexity
HIGH
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-294

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card