CVE-2023-31759
📋 TL;DR
This vulnerability allows attackers to bypass security controls in the Kerui W18 Alarm System by recording and replaying 433MHz signals from the keyfob. Attackers can gain full access to disarm or control the alarm system. This affects users of the Kerui W18 Alarm System v1.0 with the vulnerable keyfob.
💻 Affected Systems
- Kerui W18 Alarm System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain physical access to secured premises by disarming the alarm system, potentially leading to theft, property damage, or personal harm.
Likely Case
Unauthorized disarming of alarm systems allowing burglary or unauthorized entry to protected areas.
If Mitigated
Limited to physical proximity attacks requiring specialized equipment, with proper monitoring detecting unauthorized disarm events.
🎯 Exploit Status
Attack requires inexpensive SDR (Software Defined Radio) equipment and basic RF knowledge to capture and replay signals.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Contact Kerui for hardware replacement options or firmware updates if available.
🔧 Temporary Workarounds
Physical Keyfob Storage
allStore keyfobs in Faraday bags or shielded containers when not in use to prevent signal capture.
Alternative Authentication
allUse PIN codes or mobile app authentication instead of keyfob when possible.
🧯 If You Can't Patch
- Replace vulnerable keyfobs with updated versions using rolling code or encryption if available from vendor
- Implement additional physical security layers (cameras, motion sensors, door contacts) to detect unauthorized entry
🔍 How to Verify
Check if Vulnerable:
Check if your alarm system uses Kerui W18 v1.0 with 433MHz keyfob. Test with SDR equipment to see if signals can be captured and replayed.Check Version:
Check physical label on alarm system base unit for model and version information.Verify Fix Applied:
Test with SDR equipment to verify signals cannot be replayed successfully. Check for updated keyfob firmware or hardware version.📡 Detection & Monitoring
Log Indicators:
- Multiple disarm events in short timeframe
- Disarm events without corresponding authorized user activity
Network Indicators:
- Not applicable - this is RF-based attack
SIEM Query:
Not applicable for RF-based attacks. Monitor physical security system logs for suspicious disarm patterns.