Suzuki Swift 2024 RKES RollBack-style Replay Vulnerability (CVE-2026-49319)

Vulnerability Overview Vulnerability Name: Suzuki Swift (2024): Rolling-code keyless entry defeated by RollBack-style replay, enabling unauthorized lock/unlock CVE ID: CVE-2026-49319 Publication Date: June 25, 2026 Description: The Remote Keyless Entry System (RKES) of the Suzuki Swift (2024) is vulnerable to a RollBack-style capture-and-replay attack. An attacker can capture the transmission sequence of a legitimate key fob within radio range and replay these transmissions later to force the receiver to resynchronize, thereby accepting previously valid codes. This allows the vehicle to be unlocked (and locked) without the owner's key fob. Since the captured transmissions remain valid post-capture, the RollBack attack renders traditional rolling code anti-replay protections ineffective. Affected Products Affected Product: Suzuki Motor Corporation – Suzuki Swift, 2024 model year (observed on the SWIFT 15G GLS trim); Remote Keyless Entry System (RKES) rolling-code key fob, FCC ID CWTR33R0. Issue Type: CWE-294 Authentication Bypass by Capture-replay CAPEC ID: CAPEC-60 Reusing Session IDs (aka Session Replay) CVSS 3.1: 5.4 CVSS 4.0: 5.3 Remediation Recommended Mitigation: Replace counter-based rolling codes with fresh-challenge rolling codes, such as two-way challenge-response protocols. The secret key should be stored in a Secure Element specific to each vehicle. The system should reject stale or rolled-back counter values and constrain resynchronization so that previously transmitted codes are never accepted again. Distance-limiting technologies (e.g., Ultra-Wideband/UWB) further mitigate replay and relay attacks against keyless entry systems. References Reporter: Danilo Ezequiel (independent automotive cybersecurity researcher) CWE-294: https://cwe.mitre.org/data/definitions/294.html CWE-1390: https://cwe.mitre.org/data/definitions/1390.html CAPEC-60: https://capec.mitre.org/data/definitions/60.html Affected Key Fob FCC ID (public): CWTR33R0 – https://fcc.io/CWTR33R0 Attack-class Background: RollBack – a time-agnostic replay attack against automotive RKES (USENIX Security 2022) Credits Danilo Ezequiel (independent automotive cybersecurity researcher) (finder) Timeline 2026-06-25: Advisory published by ASRG. Vendor remediation pending.

Goal Reached Thanks to every supporter — we hit 100%!

Suzuki Swift 2024 RKES RollBack-style Replay Vulnerability (CVE-2026-49319)