CVE-2022-36945: Mazda Firmware

Medium severity, CVSS 6.4. EPSS: 1% chance of exploitation in the next 30 days.

The Remote Keyless Entry (RKE) receiving unit on certain Mazda vehicles through 2020 allows remote attackers to perform unlock operations and force a resynchronization after capturing three consecutive valid key-fob signals over the radio, aka a RollBack attack. The attacker retains the ability to unlock indefinitely.

Affected products

• Mazda Mazda Firmware: up to and including 2020

Published 2022-08-24. Last modified 2026-06-17.