Vulnerability · Published Jun 25, 2026 · Assigned by ASRG
CVE-2026-49319Alps Electric Co., Ltd. R53R0 Remote Keyless Entry System (RKES) Replay Attack
Medium 6.5
In plain English
A medium-severity security flaw in Remote Keyless Entry System (RKES) R53R0 from Alps Electric Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock transmissions from a legitimate key fob can later replay the same pair of transmissions repeatedly. During testing, replaying the first captured transmission caused the RKES to enter a state in which replaying the second captured transmission resulted in a successful lock or unlock operation of the vehicle. Tested and confirmed on a 2024 Suzuki Swift (SWIFT ISG GLS AC 1.2 5P 4x2 TM).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Alps Electric Co., Ltd. | Remote Keyless Entry System (RKES) R53R0 | R53R0 |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N