CVE-2025-70994 - Vulnerability Analysis

Overview

Yadea T5 Electric Bicycles (models manufactured in/after 2024) contain a broken authentication caused by use of EV1527 fixed-code RF protocol without rolling codes or cryptographic challenge-response, letting local attackers perform replay attacks for unauthorized vehicle operation.

Severity & Score

Impact

Local attackers can fully control the vehicle by replaying intercepted key fob signals, enabling unauthorized operation.

Mitigation

Update to a system implementing rolling codes or cryptographic challenge-response mechanisms.

References

• https://github.com/ktauchathuranga/CVE-2025-70994
• https://github.com/ktauchathuranga/ghost-keys

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner