SB2026021824 - Multiple vulnerabilities in Micca Car Alarm System KE700
Published: February 18, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-2540)
CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to the authentication bypass using an alternate path or channel in the alarm system’s receiver. A remote attacker on the local network can capture and replay previously transmitted signals to clone the alarm key and gain access to the vehicle to unlock or lock the doors.
2) Cleartext transmission of sensitive information (CVE-ID: CVE-2026-2539)
CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the affected system does not encrypt its data frames. A remote attacker on the local network can gain access to sensitive data.
3) Insufficient Entropy (CVE-ID: CVE-2026-2541)
CWE-ID: CWE-331 - Insufficient Entropy
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient entropy issue. A remote attacker on the local network can guess the next valid rolling code and gain unauthorized access to the car.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.