CVE-2025-56448
📋 TL;DR
The Positron PX360BT car alarm system is vulnerable to replay attacks due to improper rolling code implementation, allowing attackers to reuse captured transmissions to disarm vehicles. This affects all users of the PX360BT SW REV 8 system, potentially enabling vehicle theft despite anti-cloning claims.
💻 Affected Systems
- Positron PX360BT car alarm system
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Vehicle theft by capturing and replaying disarm signals, leading to complete loss of vehicle and property.
Likely Case
Unauthorized vehicle access and theft using inexpensive radio equipment to capture and replay signals.
If Mitigated
Limited risk if physical security measures prevent signal capture or if alternative anti-theft systems are in place.
🎯 Exploit Status
Exploitation requires physical proximity to capture signals but doesn't require authentication to the alarm system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://positron.com.br/blog/positron-lanca-alarme-px360bt-starter/
Restart Required: No
Instructions:
Contact Positron support for firmware update availability and installation instructions.
🔧 Temporary Workarounds
Physical signal shielding
allUse Faraday pouches or shielded containers for key fobs when not in use to prevent signal capture.
Supplemental security measures
allInstall additional physical anti-theft devices (steering wheel locks, kill switches) as defense-in-depth.
🧯 If You Can't Patch
- Consider replacing the alarm system with a model that implements proper rolling code security
- Implement strict physical security controls and monitoring for vehicles using this system
🔍 How to Verify
Check if Vulnerable:
Check firmware version in alarm system settings or consult manufacturer documentation for SW REV 8 identification.Check Version:
Not applicable - check through alarm system interface or manufacturer documentationVerify Fix Applied:
Verify firmware has been updated to a version beyond SW REV 8 through system settings or manufacturer confirmation.📡 Detection & Monitoring
Log Indicators:
- Repeated disarm signals from same code sequence
- Unusual disarm patterns
Network Indicators:
- RF signal capture devices detected near vehicles
- Repeated identical RF transmissions
SIEM Query:
Not applicable - primarily physical/radio frequency attack vector