CVE-2025-56448

{
  "id": "CVE-2025-56448",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-15T20:15:38.127",
  "lastModified": "2026-11-07T18:10:00.200",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling code security. The alarm system does not properly rotate or invalidate used codes, allowing repeated reuse of captured transmissions. This exposes users to significant security risks, including vehicle theft and loss of trust in the alarm's anti-cloning claims."
    },
    {
      "lang": "es",
      "value": "El sistema de alarma para coche Positron PX360BT SW REV 8 es vulnerable a un ataque de repetición debido a un fallo en la implementación de la seguridad de código variable. El sistema de alarma no rota o invalida correctamente los códigos utilizados, permitiendo la reutilización repetida de transmisiones capturadas. Esto expone a los usuarios a riesgos de seguridad significativos, incluyendo el robo de vehículos y la pérdida de confianza en las afirmaciones anti-clonación de la alarma."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-15T20:37:06.637330Z",
          "id": "CVE-2025-56448",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:positron:px360bt_firmware:rev8:*:*:*:*:*:*:*",
              "matchCriteriaId": "55DE6A92-75AF-4D93-A919-1424EFC9885E"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:positron:px360bt:8200101542:*:*:*:*:*:*:*",
              "matchCriteriaId": "64ED6D0E-C24F-44DC-BCA6-A6E9CC097A7F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://medium.com/@wagneralves_87750/cve-2025-56448-replay-attack-vulnerability-in-positron-px360bt-car-alarm-system-c9f1ccea6ebe",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://positron.com.br/blog/positron-lanca-alarme-px360bt-starter/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}