CVE-2026-49319 Alps Electric Co., Ltd. CVE debrief

Who should care

Vehicle owners and manufacturers using RKES systems with 433 MHz key fobs, particularly those using the ALPS ALPINE CO., LTD. key fob with FCC ID CWTR53R0, should assess exposure, verify vulnerability, and apply patches or updates to mitigate the risk. This includes reviewing compensating controls, monitoring for suspicious activity, and considering additional security measures.

Why it matters

CVE-2026-49319 is a medium-severity vulnerability in a remote keyless entry system that allows for roll-back attacks. Vehicle owners and manufacturers should assess exposure, verify vulnerability, and apply patches or updates to mitigate the risk.

• Unauthorized access to vehicles
• Potential for replay attacks using recorded transmissions
• Need for verification of vehicle vulnerability and patch application
• Possible impact on vehicle security and owner trust

Technical summary

The RKES system using a 433 MHz key fob bearing FCC ID CWTR53R0, manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack. An attacker within RF range can record two consecutive lock or unlock transmissions from a legitimate key fob and replay them to gain unauthorized access. This vulnerability affects vehicle owners and manufacturers using RKES systems with 433 MHz key fobs, particularly those using the ALPS ALPINE CO., LTD. key fob with FCC ID CWTR53R0. The vulnerability allows for unauthorized access to vehicles, potentially leading to security breaches and privacy concerns.

Defensive priority

Medium priority for vehicle owners and manufacturers to assess and mitigate the vulnerability.

Recommended defensive actions

• Assess exposure of RKES systems using 433 MHz key fobs
• Verify vehicle vulnerability and apply patches or updates if available
• Monitor for suspicious RKES activity
• Consider implementing additional security measures such as two-factor authentication
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was tested and confirmed on a 2024 Suzuki Swift. An attacker within RF range can record and replay transmissions to gain unauthorized access. The key fob used has the FCC ID CWTR53R0, manufactured by ALPS ALPINE CO., LTD. This vulnerability affects vehicle owners and manufacturers using RKES systems with 433 MHz key fobs.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.