Micca KE700 Car Alarm System Plaintext Rolling Code & Replay Vulnerability (CVE-2026-2539)

Critical Vulnerability Information CVE ID CVE-2026-2539 Vulnerability Overview Description: Three vulnerabilities were identified, primarily due to insecure rolling code implementation in the Micca KE700 car alarm system. The rolling codes are transmitted in plaintext, enabling attackers to read internal data and predict the next valid code. Additionally, the system has a resynchronization logic flaw that allows attackers to replay captured old signals to unlock the vehicle. This is the highest-impact vulnerability and is classified as high severity. Affected Product Information Affected Product/Component Name: OEM Car Alarm System Version: KE700 or KE700+ Vendor/OEM/Supplier: - Factory (China): MICCA AUTO ELECTRONICS CO., LTD. - Office (Hong Kong): MICCA INTERNATIONAL GROUP CO., LTD. Vulnerability Details (1): Rolling Code Transmitted in Plaintext Description: The system does not encrypt its 41-bit transmission frame, allowing any attacker to passively capture and read the frame content, including the 16-bit counter and 9-bit Key Fob ID. Attack Path: 1. The attacker passively captures a single transmission using a logic analyzer or radio hacking tool. 2. Decodes the signal (1 is transmitted as 1110, 0 as 1000). 3. Since the frame is unencrypted, the attacker can directly read the current counter value and Key Fob ID. 4. This information, especially the counter, is a critical prerequisite for launching a brute-force attack. CWE Reference: - CWE-319 Transmission of Sensitive Information in Plaintext Impact: Successful exploitation allows attackers to passively intercept and read the content of rolling code frames, compromising the confidentiality of transmissions and exposing sensitive operational data. Tools and Techniques: - Universal Radio Hacker (URH) - SDR devices (e.g., HackRF or BladeRF) - Logic analyzer Recommendations: - Implement encryption: The entire transmission frame must be encrypted using a standard, well-validated symmetric algorithm (e.g., AES-128). The receiver must decrypt the frame before processing any rolling code logic. - Validate frames: The encrypted payload should include a message authentication code (MAC) to prevent tampering or forgery. Additional Information Reporter: Danilo Erazo (revers3everything@gmail.com) Issue Type: - CWE-319 Transmission of Sensitive Information in Plaintext Affected Product: - Micca Auto Electronics Co., Ltd., Car Alarm System KE700 CVSS3.1 Score: - 4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/AU:N/V:D/RE:H

Goal Reached Thanks to every supporter — we hit 100%!

Micca KE700 Car Alarm System Plaintext Rolling Code & Replay Vulnerability (CVE-2026-2539)