CVE-2025-61081: BYD Atto3 Auth Bypass Vulnerability

CVE-2025-61081 Overview

CVE-2025-61081 affects the BYD Atto3 electric vehicle. An attacker with physical access can recover an authentication key through a brute force attack against the vehicle's diagnostic interface. The recovered key is permanently valid and is not rotated after exposure.

Once obtained, the key authorizes flashing operations on the Electronic Parking Brake (EPB) and Supplemental Restraint System (SRS) electronic control units (ECUs). Both ECUs control safety-critical functions, making firmware modification a direct threat to vehicle occupants. The weakness is categorized as improper restriction of excessive authentication attempts [CWE-307].

Critical Impact
A brute-forced, non-expiring authentication key permits unauthorized firmware flashing of safety-critical ECUs governing braking and airbag deployment.

Affected Products

BYD Atto3 electric vehicle
Electronic Parking Brake (EPB) ECU
Supplemental Restraint System (SRS) ECU

Discovery Timeline

2026-05-19 - CVE-2025-61081 published to NVD
2026-05-19 - Last updated in NVD database

Technical Details for CVE-2025-61081

Vulnerability Analysis

The BYD Atto3 uses a static authentication key to gate write access to specific ECUs over the vehicle's diagnostic bus. The authentication routine fails to enforce rate limiting, lockout thresholds, or progressive delays on failed attempts. An attacker can iterate the full key space until a valid response is observed.

Because the key does not rotate after successful authentication or failed attempts, a single brute force campaign yields persistent access. The attacker can subsequently authenticate to the EPB and SRS ECUs at any time without repeating the attack. Successful authentication unlocks flash programming routines, allowing arbitrary firmware replacement on these modules.

Flashing the EPB ECU can alter parking brake engagement behavior. Flashing the SRS ECU can disable or trigger airbag deployment. Both outcomes affect occupant safety and may not be detectable through normal vehicle diagnostics.

Root Cause

The root cause is the absence of brute force protection on the ECU authentication challenge, combined with a permanent, non-rotating key. The diagnostic protocol does not implement attempt counters, exponential backoff, or session invalidation following repeated failures. This design matches the [CWE-307] pattern of improper restriction of excessive authentication attempts.

Attack Vector

Exploitation requires physical access to the vehicle's diagnostic interface, typically the OBD-II port. An attacker connects a programming tool to the diagnostic bus and submits authentication requests in sequence. After recovery of the key, the attacker issues UDS or vendor-specific flash commands to write modified firmware to the EPB or SRS ECU.

The vulnerability is described in the CVE-2025-61081 Notion Document and the BYD Atto3 research overview. No public proof-of-concept code is currently available.

Detection Methods for CVE-2025-61081

Indicators of Compromise

High volumes of failed authentication responses on the diagnostic bus targeting EPB or SRS ECU identifiers
Unexpected ECU reset events or session control transitions during periods of vehicle inactivity
Firmware version or checksum mismatches on EPB and SRS modules during scheduled service inspections

Detection Strategies

Capture and review CAN bus traffic for repeated UDS SecurityAccess (0x27) requests against safety-critical ECUs
Validate ECU firmware integrity using signed hashes during dealer service visits
Audit diagnostic session logs for programming sessions that were not initiated by an authorized service tool

Monitoring Recommendations

Deploy intrusion detection on the in-vehicle network where supported by the OEM
Track physical access to the OBD-II port through tamper-evident covers or telematics events
Correlate post-service ECU firmware baselines with the manufacturer's expected version manifest

How to Mitigate CVE-2025-61081

Immediate Actions Required

Restrict physical access to the vehicle and the OBD-II port, including the use of locking covers
Contact an authorized BYD service center to verify EPB and SRS firmware integrity
Avoid leaving the vehicle unattended in environments where extended diagnostic access is possible

Patch Information

No vendor patch has been published in the NVD record at the time of disclosure. Owners should monitor BYD service bulletins for firmware updates that introduce brute force protection, key rotation, or signed flash enforcement on the EPB and SRS ECUs.

Workarounds

Use an OBD-II port lock or physical cover to deter unauthorized tool connections
Limit valet and third-party access to the vehicle interior
Request firmware verification during routine service appointments until a vendor fix is available

bash

# No vendor configuration mitigation is published.
# Owners should consult BYD service advisories for firmware updates addressing CVE-2025-61081.