KIA Ecuador

A significant security vulnerability has been discovered in KIA vehicles sold in Ecuador, affecting thousands of cars and exposing them to sophisticated theft techniques. The vulnerability stems from the use of outdated learning code technology instead of industry-standard rolling code systems. This makes vehicles susceptible to replay attacks and signal cloning, allowing criminals to gain unauthorized access. Despite being reported, no remediation efforts have been implemented, highlighting a broader regional problem and posing an unacceptable security risk.

Source: https://cybersecuritynews.com/kia-ecuador-keyless-entry-systems/

TPRM report: https://scoringcyber.rankiteo.com/company/kiaecuador

"id": "kia301061625",
"linkid": "kiaecuador",
"type": "Vulnerability",
"date": "6/2025",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"

{'affected_entities': [{'industry': 'Automotive',
                        'location': 'Ecuador',
                        'name': 'KIA Ecuador',
                        'type': 'Automotive Company'}],
 'attack_vector': ['Replay Attacks',
                   'Signal Cloning',
                   'Brute Force Attacks',
                   'Backdoor Code Installation'],
 'description': 'A significant security vulnerability has been discovered in '
                'KIA vehicles sold in Ecuador, potentially affecting thousands '
                'of cars and exposing them to sophisticated theft techniques.',
 'impact': {'systems_affected': 'Keyless Entry Systems'},
 'lessons_learned': 'The continued use of outdated fixed code technology '
                    'represents an unacceptable security risk that puts '
                    'vehicle owners at unnecessary risk of theft.',
 'motivation': 'Vehicle Theft',
 'post_incident_analysis': {'root_causes': 'KIA Ecuador’s use of learning code '
                                           'technology instead of the '
                                           'industry-standard rolling code '
                                           'systems'},
 'recommendations': 'Consumers should demand rolling code technology in their '
                    'vehicle key fobs and consider replacing learning code '
                    'systems with more secure alternatives.',
 'references': [{'source': 'DEFCON32 in Las Vegas'},
                {'source': 'Ekoparty 2024 in Buenos Aires'}],
 'response': {'third_party_assistance': 'Automotive Security Research Group '
                                        '(ASRG)'},
 'title': 'KIA Vehicle Keyless Entry System Vulnerability',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2025-6029'}