The vulnerability CVE-2025-61081 affects the BYD Atto3 vehicle, where an attacker can perform a brute force attack to retrieve an authentication key that remains permanently accessible. This key allows unauthorized flashing of ECUs related to the Electronic Parking Brake and Supplemental Restoration System, potentially compromising these critical vehicle safety components. There is no CVSS score or detailed vendor advisory available, and no patch or mitigation guidance has been published to date.

If exploited, an attacker could gain unauthorized access to critical vehicle ECUs controlling the Electronic Parking Brake and Supplemental Restoration System, potentially affecting vehicle safety functions. However, there are no known exploits in the wild, and the extent of impact depends on successful brute force key retrieval and subsequent ECU flashing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or mitigations are released, monitoring vendor communications and avoiding exposure of vehicle diagnostic interfaces to untrusted parties is advisable.