In BYD Atto3, brute‑forcing can reveal an authentication key that is permanently valid. That key allows the vehicle’s flash utility to rewrite firmware on the Electronic Parking Brake (EPB) and Supplemental Restoration System (SRS) ECUs. The vulnerability exists due to inadequate authentication (CWE‑307). An attacker who obtains the key could install malicious firmware, potentially disabling or misbehaving the braking or airbag systems, presenting a severe safety risk.

BYD Atto3 electric vehicle model. No specific firmware versions or hardware revisions are listed.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation data. The CVSS score of 7.5 represents high severity. The likely attack vector involves physical or in‑vehicle network access, such as a compromised OBD‑II interface or a CAN‑bus bridge. Once an attacker has obtained the key, continued malicious flashing is possible. The impact encompasses both confidentiality (key disclosure) and integrity (ECU firmware tampering) of safety‑critical systems.