BYD Atto3 Authentication Key Brute Force Vulnerability Allowing Unauthorized ECU Flashing

A vulnerability in the BYD Atto3 allows attackers to obtain an authentication key through a brute force attack. This key is permanently available and can be used to flash the Electronic Parking Brake (EPB) and Supplemental Restoration System (SRS) related Electronic Control Units (ECUs).

Impact

Exploitation of this vulnerability allows for unauthorized flashing of critical ECUs, potentially leading to unauthorized changes in vehicle functionality or safety systems.