What’s Vulnerable › Vulnerabilities

CVE-2025-70994

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-23 · updated 2026-06-17
• Weakness: CWE-1390

Description

Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal forgery after a local attacker intercepts any legitimate key fob transmission, allowing for complete unauthorized vehicle operation via a replay attack.

References

• https://github.com/ktauchathuranga/CVE-2025-70994
• https://github.com/ktauchathuranga/ghost-keys
• https://github.com/ktauchathuranga/CVE-2025-70994

Get alerted when CVE-2025-70994 or the next vulnerability affects your stack