Successful exploitation of this vulnerability could result in an attacker being able to unlock and start the bicycle, leading to vehicle theft.
The following versions of Yadea T5 Electric Bicycle are affected:
T5 Electric Bicycle vers:all/* (CVE-2025-70994)
Vendor
Equipment
Yadea
Yadea T5 Electric Bicycle
Weak Authentication
Critical Infrastructure Sectors: Transportation Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: China
Yadea T5 Electric Bicycles have a weak authentication mechanism which is vulnerable to signal forgery after a local attacker intercepts any legitimate key fob transmissions.
Yadea T5 Electric Bicycle
MitigationYadea did not respond to CISA's attempts at coordination. Users of Yadea T5 Electric Bicycles are encouraged to keep their systems up to date and lock their property securely with external mechanisms. Users can contact...