CVE-2022-27254 - Vulnerability Details - OpenCVE

The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.03133.

Key SSVC decision points have not yet been added.

Vendors	Products
Honda	Civic 2018 Civic 2018 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:honda:civic_2018_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:honda:civic_2018:-:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-31763	The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing
https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty
https://github.com/nonamecoder/CVE-2022-27254
https://news.ycombinator.com/item?id=30804702
https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/
https://www.theregister.com/2022/03/25/honda_civic_hack/

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-03-23T21:09:34

Updated: 2024-08-03T05:25:32.384Z

Reserved: 2022-03-20T00:00:00

Link: CVE-2022-27254

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-03-23T22:15:13.417

Modified: 2024-11-21T06:55:30.110

Link: CVE-2022-27254

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-03-26T07:58:57", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty"}, {"tags": ["x_refsource_MISC"], "url": "https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/nonamecoder/CVE-2022-27254"}, {"tags": ["x_refsource_MISC"], "url": "https://news.ycombinator.com/item?id=30804702"}, {"tags": ["x_refsource_MISC"], "url": "https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/"}, {"tags": ["x_refsource_MISC"], "url": "https://www.theregister.com/2022/03/25/honda_civic_hack/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-27254", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty", "refsource": "MISC", "url": "https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty"}, {"name": "https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing", "refsource": "MISC", "url": "https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing"}, {"name": "https://github.com/nonamecoder/CVE-2022-27254", "refsource": "MISC", "url": "https://github.com/nonamecoder/CVE-2022-27254"}, {"name": "https://news.ycombinator.com/item?id=30804702", "refsource": "MISC", "url": "https://news.ycombinator.com/item?id=30804702"}, {"name": "https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/", "refsource": "MISC", "url": "https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/"}, {"name": "https://www.theregister.com/2022/03/25/honda_civic_hack/", "refsource": "MISC", "url": "https://www.theregister.com/2022/03/25/honda_civic_hack/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T05:25:32.384Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nonamecoder/CVE-2022-27254"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://news.ycombinator.com/item?id=30804702"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.theregister.com/2022/03/25/honda_civic_hack/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-27254", "datePublished": "2022-03-23T21:09:34", "dateReserved": "2022-03-20T00:00:00", "dateUpdated": "2024-08-03T05:25:32.384Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:honda:civic_2018_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "436E1126-02B1-4D50-8C4A-CEAE93DDE521", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:honda:civic_2018:-:*:*:*:*:*:*:*", "matchCriteriaId": "91C4C589-8D9C-4EA0-B1E0-BBC699775071", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "The remote keyless system on Honda Civic 2018 vehicles sends the same RF signal for each door-open request, which allows for a replay attack, a related issue to CVE-2019-20626."}, {"lang": "es", "value": "El sistema remoto sin llave de los veh\u00edculos Honda Civic 2018, env\u00eda la misma se\u00f1al de RF para cada petici\u00f3n de apertura de puerta, lo que permite un ataque de repetici\u00f3n, un problema relacionado con CVE-2019-20626"}], "id": "CVE-2022-27254", "lastModified": "2024-11-21T06:55:30.110", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.9, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:A/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 5.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-03-23T22:15:13.417", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/nonamecoder/CVE-2022-27254"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://news.ycombinator.com/item?id=30804702"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.theregister.com/2022/03/25/honda_civic_hack/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://drive.google.com/file/d/1MtmWfBs1r6Y3JN1HpbNsZqO1GcsdgPdc/view?usp=sharing"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/nonamecoder/CVE-2022-27254"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://news.ycombinator.com/item?id=30804702"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.bleepingcomputer.com/news/security/honda-bug-lets-a-hacker-unlock-and-start-your-car-via-replay-attack/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.theregister.com/2022/03/25/honda_civic_hack/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "nvd@nist.gov", "type": "Primary"}]}