CVE-2022-38766

Published: Jan 3, 2023Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 2.8 / Impact: 5.2

Source: NVD

Description

The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.

Affected (1)

Products: Renault: Zoe E Tech Firmware

Renault

1 product

Zoe E Tech Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Renault Zoe E Tech Firmware	Version 2021

Running on/with	Platform Versions
Renault Zoe E Tech	All versions

Related CWEs

CWE-294

Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

References (2)

https://github.com/AUTOCRYPT-IVS-VnV/CVE-2022-38766

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/AUTOCRYPT-IVS-VnV/CVE-2022-38766

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.