CVE-2025-61081
📛 CVE Title
CVE-2025-61081
Description
In BYD Atto3, an attacker can obtain an authentication key through Brute Force attack, which is permanently available. The authentication key enables flash to the Electronic Parking Break (EPB) and Supplemental Restoration System (SRS) related ECUs.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- mitre
- CVSS severity
- high
- CVSS score
- 7.5 / 10
- CVSS vector
AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H- Effective score
- 7.5 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- 2025-09-26
- Published
- 2026-05-19 00:00 UTC
- Last updated
- 2026-05-19 18:13 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/61xxx/CVE-2025-61081.json
- Linked Threat
- CVE-2025-61081 — CVE-2025-61081
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-19 18:16:19 UTC
- NVD last modified
- 2026-05-19 21:05:49 UTC
- NVD CVSS v3.1
- 7.5 / 10 HIGH source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
- NVD CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H- Exploitability subscore
- 0.9 / 10
- Impact subscore
- 6.0 / 10
- EPSS score
- 0.0002 (probability of exploitation in next 30 days)
- EPSS percentile
- 7.24% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-307
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:30 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2025-209899 - Assigner
- mitre
- Published
- May 19, 2026, 12:00:00 AM
- Updated
- May 19, 2026, 6:13:43 PM
- EUVD base score (CVSS 3.1)
-
7.5 / 10
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H - EUVD-reported EPSS
- 0.0300
- Vendors
- n/a
- Products
-
n/a (n/a)
- Aliases
-
GHSA-h596-vpgv-58r7
ENISA description: In BYD Atto3, an attacker can obtain an authentication key through Brute Force attack, which is permanently available. The authentication key enables flash to the Electronic Parking Break (EPB) and Supplemental Restoration System (SRS) related ECUs.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| n/a | n/a |
n/a (affected)
|
— |
Vendor references (2)
References embedded in the original CVE record by the assigning CNA.
Web references (5)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2025-61081 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2025-61081 tenable:www.cve.org
- https://www.first.org/epss/ tenable:www.first.org
- https://www.notion.so/BYD-Atto3-26215fb6156c8000b338db3c2011f637?source=copy_link tenable:www.notion.so
- https://www.notion.so/CVE-2025-61081-26215fb6156c8000b338db3c2011f637 tenable:www.notion.so
NVD-tagged references (4)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://www.notion.so/BYD-Atto3-26215fb6156c8000b338db3c2011f637?source=copy_link cve@mitre.org
- https://www.notion.so/BYD-Atto3-26215fb6156c8000b338db3c2011f637?source=copy_link 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.notion.so/CVE-2025-61081-26215fb6156c8000b338db3c2011f637 cve@mitre.org
- https://www.notion.so/CVE-2025-61081-26215fb6156c8000b338db3c2011f637 134c704f-9b21-4f2e-91b3-4a467353bcc0
Remediations (19)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.qualys.com
As the year winds down, Microsoft Patch Tuesday in December arrives with essential fixes and enhancements to close vulnerabilities and boost performance.
2026-05-23 22:19 UTC -
web:cybersecuritynews.com
Microsoft released its final Patch Tuesday updates of 2025 on December 9, addressing 56 security vulnerabilities across Windows, Office, Exchange Server, and other components.
2026-05-23 22:19 UTC -
web:learn.microsoft.com
Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.
2026-05-23 22:19 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-05-23 22:19 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-23 22:19 UTC -
web:www.absolute.com
Microsoft Patch Tuesday August 2025 delivers 109 fixes, including critical vulnerabilities in MSMQ, NTLM, and graphics components. Stay protected.
2026-05-23 22:19 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's November 2025 Patch Tuesday, which includes security updates for 63 flaws, including one actively exploited zero-day vulnerability.
2026-05-23 22:19 UTC -
web:www.bleepingcomputer.com
Today is Microsoft's October 2025 Patch Tuesday, which includes security updates for 172 flaws, including six zero-day vulnerabilities. Get patching!
2026-05-23 22:19 UTC -
web:www.malwarebytes.com
Run Windows Update today, restart your PC, and check you're up to date. What's been fixed Microsoft releases important security updates on the second Tuesday of every month—known as " Patch Tuesday." This month's patches fix critical flaws in Windows 10, Windows 11, Windows Server, Office, and related services.
2026-05-23 22:19 UTC -
web:www.tenable.com
Microsoft addresses 56 CVEs , including two publicly disclosed vulnerabilities and one zero-day that was exploited in the wild to close out the final Patch Tuesday of 2025
2026-05-23 22:19 UTC -
web:app.opencve.io
Apply the vendor‑issued security patch that removes the permanent authentication key exposure. Implement strict authentication, network segmentation, and firewall policies to restrict diagnostic and in‑vehicle network interfaces, ensuring that only authorized devices can communicate with the EPB and SRS ECUs.
2026-05-26 02:59 UTC -
web:learn.microsoft.com
Microsoft December 2025 Security Updates This release consists of the following 57 Microsoft CVEs : Tag CVE Base Score CVSS Vector Exploitability FAQs? Workarounds? Mitigations ? Windows PowerShell CVE - 2025 -54100 Windows Projected File System…
2026-05-26 02:59 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-05-26 02:59 UTC -
web:msrc.microsoft.com
Access Microsoft Security Response Center's guide to address vulnerabilities, manage security risks, and keep your systems protected with the latest updates.
2026-05-26 02:59 UTC -
web:ubuntu.com
One subscription for security maintenance, support, FIPS and other compliance certifications.
2026-05-26 02:59 UTC -
web:www.crowdstrike.com
Microsoft has released security updates for 107 vulnerabilities, including one publicly disclosed zero-day and 13 critical, in its August 2025 Patch Tuesday rollout.
2026-05-26 02:59 UTC -
web:www.microsoft.com
These Knowledge Base articles accompany all security updates and advisories, and include caveats or known issues with security updates. Additionally, support engineers document common concerns from customers in these KB articles. These Knowledge Base articles are published the Security Update Guide with each release on Patch Tuesday.
2026-05-26 02:59 UTC -
web:www.microsoft.com
Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.
2026-05-26 02:59 UTC -
web:www.oracle.com
This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.
2026-05-26 02:59 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2025-61081.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-61081",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-19T18:11:46.135176Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307 Improper Restriction of Excessive Authentication Attempts",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T18:13:43.105Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/BYD-Atto3-26215fb6156c8000b338db3c2011f637?source=copy_link"
},
{
"tags": [
"exploit"
],
"url": "https://www.notion.so/CVE-2025-61081-26215fb6156c8000b338db3c2011f637"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In BYD Atto3, an attacker can obtain an authentication key through Brute Force attack, which is permanently available. The authentication key enables flash to the Electronic Parking Break (EPB) and Supplemental Restoration System (SRS) related ECUs."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-19T17:32:02.055Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.notion.so/BYD-Atto3-26215fb6156c8000b338db3c2011f637?source=copy_link"
},
{
"url": "https://www.notion.so/CVE-2025-61081-26215fb6156c8000b338db3c2011f637"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2025-61081",
"datePublished": "2026-05-19T00:00:00.000Z",
"dateReserved": "2025-09-26T00:00:00.000Z",
"dateUpdated": "2026-05-19T18:13:43.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}