PT-2015-5968 · Mobile Devices · Mobile Devices C4 Obd-Ii Dongle

Ian Foster · Published 2015-08-23 · Updated 2023-03-01 · CVE-2015-2907

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mobile Devices (aka MDI) C4 OBD-II dongles versions 2.x through 3.4.x

Description The issue allows remote attackers to obtain access by leveraging knowledge of the required username and password, due to hardcoded SSH credentials.

Recommendations For versions 2.x through 3.4.x, consider disabling SSH access until a patch is available. Restrict access to the device to minimize the risk of exploitation. Avoid using the hardcoded username and password in the affected SSH connection until the issue is resolved.

Fix

Related Identifiers

CVE-2015-2907

Affected Products

Mobile Devices C4 Obd-Ii Dongle

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-2907 · Security Note
• http://kb.cert.org/vuls/id/209512 · Note
• https://usenix.org/conference/woot15/workshop-program/presentation/foster · Note