leviathan/KAT
1
1
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

CVE updates

Browse Source
This commit is contained in:
KaraZajac
2026-02-21 00:22:12 -05:00
parent 024b55a2a8
commit b4e6898113
2 changed files with 58 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -247,6 +247,7 @@ KAT matches capture metadata (Year / Make / Model / Region, set via **i** on a c
|-----|---------|--------|------------|-------------|
| [CVE-2022-38766](https://nvd.nist.gov/vuln/detail/CVE-2022-38766) | Renault | ZOE | 2020–2022 | Replay attack: same rolling code set per door-open request (433.92 MHz). |
| [CVE-2022-27254](https://nvd.nist.gov/vuln/detail/CVE-2022-27254) | Honda | Civic | 2016–2019 | Replay attack: same RF signal per door-open request (related to CVE-2019-20626). |
| [CVE-2019-20626](https://nvd.nist.gov/vuln/detail/CVE-2019-20626) | Honda, Acura | HR-V, Civic, Accord; TSX | 2009, 2016–2020 (by model) | Replay attack: same RF signal per door-open request (static code, no rolling code). Confirmed vehicles per [Unoriginal-Rice-Patty](https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty). |
| [CVE-2022-37418](https://nvd.nist.gov/vuln/detail/CVE-2022-37418) | Honda, Hyundai, Kia, Nissan | Fit (hybrid), Fit, City, Vezel; Elantra; Cerato, Forte, K3; Latio, Sylphy | 2007–2022 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing two consecutive key fob signals; attacker can unlock indefinitely. |
| [CVE-2022-36945](https://nvd.nist.gov/vuln/detail/CVE-2022-36945) | Mazda | 3, 2 Sedan, 2 HB (facelift), Cx-3, Cx-5 | 2018–2020 (varies by model) | **RollBack attack:** RKE allows unlock and resync after capturing **three** consecutive key fob signals; attacker can unlock indefinitely. |
src/vuln_db.rs
+57 -1
View File
@@ -26,7 +26,7 @@ pub struct VulnEntry {
pub url: &'static str,
}
pub const VULN_DB: [VulnEntry; 16] = [
pub const VULN_DB: [VulnEntry; 21] = [
VulnEntry {
id: 1,
cve: "CVE-2022-38766",
@@ -209,6 +209,62 @@ pub const VULN_DB: [VulnEntry; 16] = [
description: "RKE RollBack: unlock/resync after capturing two consecutive key fob signals. Attacker can unlock indefinitely.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2022-37418",
},
// CVE-2019-20626: Honda/Acura static code replay (no rolling code). Confirmed vehicles per Unoriginal-Rice-Patty.
VulnEntry {
id: 17,
cve: "CVE-2019-20626",
year_start: "2009",
year_end: "2009",
makes: &["Acura"],
models: &["TSX"],
region: "ALL",
description: "The remote keyless system sends the same RF signal for each door-open request, which might allow a replay attack. Honda/Acura use static codes (no rolling code).",
url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
},
VulnEntry {
id: 18,
cve: "CVE-2019-20626",
year_start: "2016",
year_end: "2016",
makes: &["Honda"],
models: &["Accord"],
region: "ALL",
description: "The remote keyless system sends the same RF signal for each door-open request, which might allow a replay attack. Honda/Acura use static codes (no rolling code).",
url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
},
VulnEntry {
id: 19,
cve: "CVE-2019-20626",
year_start: "2017",
year_end: "2017",
makes: &["Honda"],
models: &["HR-V"],
region: "ALL",
description: "The remote keyless system on Honda HR-V 2017 vehicles sends the same RF signal for each door-open request, which might allow a replay attack.",
url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
},
VulnEntry {
id: 20,
cve: "CVE-2019-20626",
year_start: "2018",
year_end: "2018",
makes: &["Honda"],
models: &["Civic"],
region: "ALL",
description: "The remote keyless system sends the same RF signal for each door-open request, which might allow a replay attack. Honda/Acura use static codes (no rolling code).",
url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
},
VulnEntry {
id: 21,
cve: "CVE-2019-20626",
year_start: "2020",
year_end: "2020",
makes: &["Honda"],
models: &["Civic"],
region: "ALL",
description: "The remote keyless system sends the same RF signal for each door-open request, which might allow a replay attack. Honda/Acura use static codes (no rolling code).",
url: "https://nvd.nist.gov/vuln/detail/CVE-2019-20626",
},
];
/// Match a capture's year/make/model/region against the DB.