On December 2, 2025, my co-authors and I posted the write-up behind CVE-2025-6666: a coordinated disclosure of cryptographic weaknesses in the motogadget mo.lock, a contactless NFC vehicle ignition lock. The vulnerability was published on the National Vulnerability Database on November 29, 2025. The research was mine together with M. P. Faith and A. C. Buglione.
The flaw is a clean example of what goes wrong when a product treats a public identifier as if it were a secret. Each mo.lock key carries a 7-byte serial number (UID) that any smartphone can read in a fraction of a second, without permission. An attacker with brief physical proximity to the key reads that UID, then uses an ISO 14443-A emulator (a Flipper Zero or a Proxmark3) to replay it to any mo.lock unit and iterate through the limited 16-bit password verification space until the lock returns the authentication data needed to clone the key. No access to the target vehicle is required, and because the clone is a perfect digital duplicate, its use is forensically untraceable.
The root cause is two design decisions compounding each other. A cryptographic secret is reused globally across every unit, so every lock in the field is an oracle willing to validate any captured UID. And the password verification space is small enough to exhaust by brute force. Authentication built on publicly readable data plus an easily guessed value is not authentication.
For two decades my public work has been advocacy: putting implants in my own hands and arguing they are safe and useful. This is the other half of the same coin. If I am going to ask people to trust contactless devices, I have to be willing to take them apart and say so when the cryptography does not hold up. We contacted the vendor early in the process. Per the NVD entry, motogadget "was contacted early about this disclosure but did not respond in any way."
For the archive: the NVD entry is CVE-2025-6666; our disclosure document is hosted here; and the companion preprint, "Cryptographic Weaknesses in Contactless Vehicle Ignition Locks" (A. E. Graafstra, M. P. Faith, A. C. Buglione), was posted to Authorea on December 2, 2025 and is not yet peer-reviewed: DOI 10.22541/au.176463785.56572068/v1.