CVE-2026-49319
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Remote Keyless Entry System (RKES) using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD. is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a legitimate key fob can later replay the same pair of transmissions repeatedly, resulting in a successful lock or unlock operation of the vehicle.
Risk Assessment
The organization is at risk of unauthorized access to the vehicle, which could lead to theft of property or physical security breaches. The attack requires only physical proximity and recording of two signals, making it easy to execute.
Recommendation
Immediately contact the vehicle manufacturer to obtain a firmware update for the RKES that eliminates the roll-back attack vulnerability. Until the patch is applied, it is recommended to use additional security mechanisms such as mechanical locks.
Related vulnerabilities
- CVE-2026-87855Critical
The JTL-Connector plugin for WooCommerce up to version 2.4.3 is vulnerable to arbitrary file upload via the saveImage() function. This is due to accepting an empty jtlauth parameter as valid credentials and insufficient file type validation in handleImagePush(). This allows unauthenticated attackers to upload executable files, leading to remote code execution.
- CVE-2026-104800Critical
The AGE-GATE plugin for WordPress up to version 1.0 is vulnerable to remote code execution via the 'width' and 'height' parameters. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters into generated PHP source. This allows unauthenticated attackers to execute code on the server.
- CVE-2026-97668Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to SQL injection via the guest cart persistent meta_value. This is due to insufficient escaping and lack of prepared statements in the update_guest_persistent_cart() function. The abandoned_cart_info value is concatenated directly into an UPDATE statement, allowing unauthenticated attackers to append additional SQL, potentially leading to data extraction and privilege escalation.
- CVE-2026-97657Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to authentication bypass via malleable encryption and bypassable HMAC. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens and a conditional HMAC check that can be bypassed by omitting the wcap_nonce parameter. This allows unauthenticated attackers with a single legitimate link to forge ciphertext and take over any user's account, including administrators.
- CVE-2026-110447Critical
Collabora Online Built-in CODE Server before version 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, exploited in the wild in September and October 2026. This is an OS command injection in proxy.php when the CODE server isn't running. The vulnerability is not present in standalone Collabora Online servers.
- CVE-2026-110002Critical
The Snazzy Social Media Feed plugin for WordPress up to version 2.5 is vulnerable to arbitrary file upload via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter. This allows authenticated attackers with subscriber-level access and above to upload executable files, leading to remote code execution.
- CVE-2026-93388Critical
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce up to version 2.9.1 is vulnerable to unauthenticated arbitrary file upload leading to remote code execution. The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers, and its Google Drive branch rebuilds the destination filename from the raw gapi[name] parameter, bypassing the allow-list, and writes the fetched bytes to a web-accessible directory. This allows unauthenticated attackers to write a .php file to an executable location and execute arbitrary code on the server.
- CVE-2026-92097Critical
The Click to Chat for WhatsApp plugin for WordPress up to version 4.44 is vulnerable to arbitrary shortcode execution. This is due to the greetings_dialog() function building the {url} placeholder from a filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted content to do_shortcode() without stripping shortcode delimiters. This allows unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin.
- CVE-2026-110392Critical
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows OS Command Injection.
- CVE-2026-97381Critical
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
Original NVD description (English source)
Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a legitimate key fob can later replay the same pair of transmissions repeatedly. During testing, replaying the first captured transmission caused the RKES to enter a state in which replaying the second captured transmission resulted in a successful lock or unlock operation of the vehicle. Tested and confirmed on a 2024 Suzuki Swift (SWIFT ISG GLS AC 1.2 5P 4x2 TM).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS