Security readout for executives and security teams
Plain-English summary
The mo.lock ignition lock reportedly contains a fixed cryptographic key in its NFC handling. An attacker would need physical access and overcome high attack complexity. The assessed impact is limited disclosure of confidential information, with no reported integrity or availability impact. No vendor-confirmed fix is identified in the supplied sources.
Executive priority
Handle through routine vulnerability management, prioritizing units protecting valuable or safety-sensitive assets. Immediate enterprise-wide emergency action is not supported by the low score, physical-access requirement, high complexity, or lack of confirmed active exploitation. Escalate if vendor guidance broadens impact or attacks are reported.
Technical view
CVE-2025-6666 concerns unknown NFC Handler functionality in motogadget mo.lock Ignition Lock versions described as up to 20251125. It is classified under hard-coded cryptographic key weaknesses. CVSS 3.1 scores it 2.0: physical access, high complexity, no privileges or user interaction, low confidentiality impact, and no integrity or availability impact.
Likely exposure
Exposure is limited to organizations or individuals using affected mo.lock Ignition Lock hardware. Internet-facing systems are not implicated. Risk depends on an attacker obtaining physical access to the device. The supplied affected-version data names 20251125, while the description says versions up to that date; confirm scope with the vendor.
Exploitation context
The bundle marks this CVE as absent from KEV, and the supplied sources do not establish active exploitation. The CVSS temporal vector indicates proof-of-concept-level exploit maturity, but physical access and high complexity reportedly make exploitation difficult. Treat this as potential exploitability, not evidence of attacks in the wild.
Researcher notes
The public record is incomplete: the affected NFC functionality is unspecified, the vendor reportedly did not respond, and no patch is named. The version presentation is also ambiguous between version 20251125 and versions up to that date. Avoid assuming key reuse scope, authentication bypass, vehicle operation, or broader impact without additional evidence.
Mitigation direction
- Inventory deployed mo.lock Ignition Lock devices and record their identifiable versions or production dates.
- Restrict physical access to vehicles, devices, NFC components, and maintenance environments.
- Check motogadget guidance for affected revisions, updates, replacements, or compensating controls.
- Use independent physical safeguards where reliance on the ignition lock creates material risk.
- Monitor the CVE and vendor communications because the supplied sources identify no confirmed fix.
Validation and detection
- Confirm whether deployed hardware is the mo.lock Ignition Lock model.
- Compare each unit's version or production date with the reported affected range.
- Ask motogadget to confirm affected revisions and whether a corrected product exists.
- Document each device's physical accessibility and existing independent safeguards.
- Review credible vendor or CVE updates for revised scope, exploitation evidence, or remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-320: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-321: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-6666 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R0.51.4VulDBCVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R0.51.4VulDBAV:L/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR1.92.9VulDBCVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P——VulDBVulnerability scoring details
Base CVSS 4.0 score
1LowVector: CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
2LowVector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
Base CVSS 3.0 score
2LowVector: CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
Base CVSS 2.0 score
1.2LowVector: AV:L/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
- Source timelineVulDB
VulDB entry last update
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-333785 | motogadget mo.lock Ignition Lock NFC hard-coded keyCVE reference, VulDB · vdb-entry, technical-description
- VDB-333785 | CTI Indicators (IOB, IOC, TTP)CVE reference, VulDB · signature, permissions-required
- CVE-2025-6666 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #701162 | motogadget mo.lock NFC CWE-290, CWE-327, CWE-1394CVE reference, VulDB · third-party-advisory
- https://doi.org/10.22541/au.176463785.56572068/v1CVE reference, VulDB · broken-link
- https://office.dngr.us/s/iZHrwtf2xRPoeJj/downloadCVE reference, VulDB · related
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Key Management Errors
Key Management Errors represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Use of Hard-coded Cryptographic Key
Use of Hard-coded Cryptographic Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.