CVE-2026-49319 describes a vulnerability in the Alps Electric RKES R53R0 that enables an attacker to perform a roll-back replay attack on the rolling-code authentication used by the key fob operating at 433 MHz. By capturing two consecutive transmissions from a legitimate key fob, an attacker can replay these transmissions to cause the vehicle to accept unauthorized lock or unlock commands. Testing confirmed that replaying the first captured transmission puts the system into a state where the second replayed transmission successfully executes the lock or unlock operation. This vulnerability affects the integrity of the vehicle's remote locking mechanism and was demonstrated on a 2024 Suzuki Swift.

The vulnerability allows an attacker within radio frequency range to bypass the authentication mechanism of the remote keyless entry system, enabling unauthorized locking or unlocking of the vehicle. This compromises the integrity of the vehicle's access control, potentially allowing unauthorized physical access. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or vendor advisory has been provided at this time. Until a fix is available, users should be aware of the risk of replay attacks and consider additional physical security measures. Avoid leaving vehicles unattended in high-risk areas where attackers could capture RF signals.