CVE-2025-6666 motogadget mo.lock Ignition Lock NFC hard-coded key
Attackers can bypass the ignition lock security by exploiting a hard-coded cryptographic key in the NFC handler of the motogadget mo.lock device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-6666?
CVE-2025-6666 is a low-severity vulnerability in motogadget mo.lock Ignition Lock, published on 29 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionality of the component NFC Handler. Executing a manipulation can lead to use of hard-coded cryptographic key . The physical device can be targeted for the attack. A high complexity level is associated with this attack. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-6666?
How do I fix CVE-2025-6666?
No fix has been published for CVE-2025-6666 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-6666 being exploited?
There is no known exploitation of CVE-2025-6666 in the wild and no public exploit code.
Sources
Also known as GHSA-x92v-4f2v-7xr4.