Vulnerability · Published Feb 15, 2026 · Assigned by ASRG

CVE-2026-2540Micca KE700 Acceptance of previously used rolling codes

High 8.4

In plain English

A high-severity authentication bypass in Car Alarm System KE700 from Micca Auto Electronics Co., Ltd.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.2%top 87.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires sending two previously captured codes in a specific sequence. As a result, the system can be forced to accept previously used (stale) rolling codes and execute a command. Successful exploitation allows an attacker to clone the alarm key. This grants the attacker unauthorized access to the vehicle to unlock or lock the doors.

Affected products (as reported)

Vendor	Product	Versions
Micca Auto Electronics Co., Ltd.	Car Alarm System KE700	KE700

Weakness: CWE-288, CWE-294 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:L/SA:H/V:D/RE:M

References

https://asrg.io/security-advisories/cve-2026-2540/ third-party-advisory