CVE-2025-70994

HIGH

Yadea T5 Electric Bicycles 2024 - Auth Bypass

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-70994. PoCs published by adminlove520, ktauchathuranga.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2025-70994, a weak authentication vulnerability in the Yadea T5 Electric Bicycle's keyless entry system. It explains the EV1527 fixed-code RF protocol flaw and includes a passive signal analyzer PoC for educational purposes.

Description

Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system. The system utilizes the EV1527 fixed-code RF protocol without implementing rolling codes or cryptographic challenge-response mechanisms. This is vulnerable to signal forgery after a local attacker intercepts any legitimate key fob transmission, allowing for complete unauthorized vehicle operation via a replay attack.

Exploits (2)

github WRITEUP 3 stars
by adminlove520 · pythonpoc
https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2025/CVE-2025-70994

This repository provides a detailed technical analysis of CVE-2025-70994, a weak authentication vulnerability in the Yadea T5 Electric Bicycle's keyless entry system. It explains the EV1527 fixed-code RF protocol flaw and includes a passive signal analyzer PoC for educational purposes.

Classification
Writeup 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Yadea T5 Electric Bicycle (models manufactured in/after 2024)
No auth needed
Prerequisites: ESP8266 (NodeMCU/Wemos D1) · CC1101 RF Transceiver Module (SPI Interface)
devstral-2 · analyzed Apr 24, 2026 Full analysis →
nomisec WRITEUP
by ktauchathuranga · poc
https://github.com/ktauchathuranga/CVE-2025-70994

This repository provides a detailed technical analysis of CVE-2025-70994, a weak authentication vulnerability in the Yadea T5 Electric Bicycle's keyless entry system. It explains the EV1527 fixed-code RF protocol flaw and includes a passive signal analyzer PoC for educational purposes.

Classification
Writeup 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Yadea T5 Electric Bicycle (models manufactured in/after 2024)
No auth needed
Prerequisites: ESP8266 (NodeMCU/Wemos D1) · CC1101 RF Transceiver Module (SPI Interface) · Proximity to target vehicle
devstral-2 · analyzed May 03, 2026 Full analysis →

Scores

CVSS v3 7.3
EPSS 0.0027
EPSS Percentile 19.0%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-1390
Status published
Published Apr 23, 2026
Tracked Since Apr 23, 2026