CVE-2025-30072: Tiwee X1 Alarm System Authentication Bypass via Capture-replay

Critical Vulnerability Information Vulnerability Type: Authentication Bypass by Capture-replay Risk Level: CVSS 3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Affected Product: Tiwee X1 Alarm System Manufacturer: Tiwee B.V. Affected Version: TMWXAKV2 Tested Version: TMWXHAKV2 CVE Reference: CVE-2025-30072 Public Disclosure Date: 2025-05-12 Vulnerability Details Overview: Due to the lack of security features such as rolling codes or encryption, the Tiwee X1 alarm system is vulnerable to replay attacks over 433 MHz radio communication. Details: The alarm system’s remote control signals can be captured and replayed using appropriate antennas and software-defined radio software. Once captured, the signals can be directly replayed or recalculated and resent. Mitigation Recommendation: If capture-replay attacks constitute a valid attack vector for your assets, do not use this device. Disclosure Timeline Vulnerability Discovered: 2025-01-22 Reported to Vendor: 2025-01-27 Public Disclosure: 2025-05-12 References [1] Amazon Link: https://www.amazon.de/dp/B08B8T95NH [2] Product Manual: https://www.tiwee.com/files/l/1880/6197/files/Manual_Tiwee_X1_ALL_LANGUAGES_WEB.pdf7406 [3] Flipper Zero: https://flipperzero.one/ [4] Security Advisory: https://www.sys.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-006.txt [5] SySS Responsible Disclosure Policy: https://www.syss.de/en/responsible-disclosure-policy

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-30072: Tiwee X1 Alarm System Authentication Bypass via Capture-replay