CVE-2025-70994: Weak Authentication in Yadea T5 Electric Bicycle

[!WARNING] This repository is published strictly for educational and academic security research purposes. The information and proof-of-concept code provided here are intended to demonstrate a known cryptographic flaw (CWE-1390) to assist vehicle owners and manufacturers in understanding and improving physical security.

The author does not condone, encourage, or support unauthorized access to vehicles or any illegal activities. The proof-of-concept code is strictly a passive signal analyzer and contains no transmission or exploitation capabilities. Users are solely responsible for complying with all applicable local, state, and federal laws. Unauthorized interception of RF signals may be illegal in your jurisdiction.

---

Executive Summary

A high-risk security vulnerability has been identified in the keyless entry system of the Yadea T5 Electric Bicycle (models manufactured in/after 2024). The system utilizes the EV1527 fixed-code RF protocol over the 433.92 MHz ISM band without implementing rolling codes or cryptographic challenge-response mechanisms.

For a comprehensive academic analysis of this vulnerability, please refer to the published research paper.

Because the 20-bit vehicle address is static and decoupled from command authorization, an attacker within proximity can intercept a non-sensitive command (e.g., ringing the vehicle's bell) and mathematically synthesize a high-sensitivity command (e.g., "Start/Ignition"). This allows for complete unauthorized vehicle operation via a replay attack.

---

Technical Breakdown

Protocol Architecture (EV1527)

The system relies on an EV1527-compatible RF encoder. Each transmission consists of a 24-bit data payload transmitted via On-Off Keying (OOK) Pulse Width Modulation.

Frame Structure:

1. Sync Pulse: ~11.2ms duration (1 high, 31 low periods)
2. 24-bit Payload:
   • [Bits 23-4] Address/ID: A fixed 20-bit identifier unique to the specific remote.
   • [Bits 3-0] Command: A 4-bit instruction (e.g., Lock, Unlock, Start, Bell).

The Authentication Flaw

The core vulnerability stems from the lack of sequential counters (rolling codes). The vehicle's receiver authenticates commands solely by verifying the 20-bit Address.

Because this address never changes, capturing any legitimate signal exposes the static key. An attacker can record the signal, extract the 20-bit ID, append the standardized hex code for "Start" (0x2), and broadcast the synthesized 24-bit frame. The vehicle will accept the forged command as legitimate.

Standard Command Mappings:

---

Mitigation & Countermeasures

For Vehicle Owners

The electronic lock is fundamentally compromised by this protocol flaw. Owners of the Yadea T5 are strongly advised to:

1. Disregard the electronic keyless entry system for security purposes.
2. Utilize heavy-duty physical locking mechanisms (e.g., U-locks, hardened chains) anchored to immovable objects.
3. Utilize the mechanical steering lock.

For Manufacturers

1. Deprecate the use of EV1527, PT2262, and related fixed-code ICs for security-critical applications.
2. Transition to cryptographic rolling-code implementations (e.g., AES-128, KeeLoq).

---

Proof of Concept: Signal Analyzer

The provided poc_analyzer.cpp is a stripped-down Arduino script designed for the ESP8266 and CC1101 transceiver. It demonstrates the vulnerability by passively listening to the 433.92 MHz band, identifying the EV1527 sync pulse, and decoding the 24-bit frame into plaintext, effectively exposing the static vehicle ID.

Hardware Requirements:

• ESP8266 (NodeMCU/Wemos D1)
• CC1101 RF Transceiver Module (SPI Interface)

---

Disclosure Timeline

A standard 90-day responsible disclosure window was initiated on December 31, 2025. Following a lack of substantive vendor remediation, coordination was established with the U.S. Department of Homeland Security (CISA). The embargo was ultimately extended to April 23, 2026, to allow for a synchronized federal security advisory.

Click to expand the Full Communication Log

• 2025-12-31: SECURITY VULNERABILITY: Critical Authentication Flaw in Yadea T5 Keyless Entry System sent to [email protected].
• 2026-01-08: RE: SECURITY VULNERABILITY: Critical Authentication Flaw in Yadea T5 (Follow-up) sent to [email protected] and [email protected].
• 2026-02-24: Re: SECURITY VULNERABILITY: Critical Authentication Flaw in Yadea T5 Keyless Entry System, CVE-2025-70994 Assigned sent to [email protected] and [email protected].
• 2026-02-26: Reached Yadea Employee 01 (Through Linkedin).
• 2026-02-26: Reached Yadea Employee 02 (Through Linkedin).
• 2026-03-01: Reached Yadea Linkedin Business Page.
• 2026-03-02: URGENT: Coordinated Disclosure Escalation - Yadea T5 Electric Bicycle (CVE-2025-70994) / 紧急：协调漏洞披露升级 - 雅迪 T5 电动自行车 (CVE-2025-70994) sent to [email protected].
• 2026-03-02: Contact the SEI - Ashen, Chathuranga - 03/01/26 via https://www.sei.cmu.edu/contact-us/.
• 2026-03-02: Reached Abans Group Sri Lanka (Through Linkedin).
• 2026-03-02: Reached Abans Auto - Yadea (Through Linkedin).
• 2026-03-03: Thank you for submitting VRF#26-03-NVVXM to VINCE (https://kb.cert.org/vince/comm/report/).

---

References

• Research Paper: Exploiting Fixed-Code RF Protocols in MicroMobility (CVE-2025-70994)
• CISA ICS Advisory: ICSA-26-113-01
• CWE-1390: Weak Authentication
• EV1527 Datasheet
• CVSS v3.1 Calculator
• CVE-2025-70994 on MITRE

---

Author

Ashen Chathuranga — Researcher