PT-2016-5131 · Lemur Vehicle Monitors · Bluedriver

Dan Klinedinst · Publicado 2016-04-22 · Atualizado 2016-05-31 · CVE-2016-2354

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lemur Vehicle Monitors BlueDriver versions prior to 2016-04-07

Description The issue concerns the Bluetooth functionality, which allows for unrestricted pairing without a PIN. This enables remote attackers to send arbitrary CAN commands by accessing a device inside or adjacent to the vehicle. For example, an attacker could disrupt braking or steering by sending a specific CAN command.

Recommendations For versions prior to 2016-04-07, consider disabling the Bluetooth functionality until a fix is available to prevent unauthorized access. Restrict physical access to the vehicle and its devices to minimize the risk of exploitation.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-2354

Produtos afetados

Bluedriver

Referências · 3

• https://osv.dev/vulnerability/CVE-2016-2354 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/615456 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-2354 · Nota de Segurança