PT-2015-5968 · Mobile Devices · Mobile Devices C4 Obd-Ii Dongle

Ian Foster · Publicado 2015-08-23 · Atualizado 2023-03-01 · CVE-2015-2907

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mobile Devices (aka MDI) C4 OBD-II dongles versions 2.x through 3.4.x

Description The issue allows remote attackers to obtain access by leveraging knowledge of the required username and password, due to hardcoded SSH credentials.

Recommendations For versions 2.x through 3.4.x, consider disabling SSH access until a patch is available. Restrict access to the device to minimize the risk of exploitation. Avoid using the hardcoded username and password in the affected SSH connection until the issue is resolved.

Correção

Identificadores relacionados

CVE-2015-2907

Produtos afetados

Mobile Devices C4 Obd-Ii Dongle

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-2907 · Nota de Segurança
• http://kb.cert.org/vuls/id/209512 · Nota
• https://usenix.org/conference/woot15/workshop-program/presentation/foster · Nota