Summaryinfo

A vulnerability has been found in C4B OBD-II Dongle 2.x/3.4.x and classified as critical. The impacted element is an unknown function of the component SSH Key. The manipulation leads to improper authentication. This vulnerability is documented as CVE-2015-2906. There is not any exploit available. The presence of this vulnerability remains uncertain at this time. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Detailsinfo

A vulnerability was found in C4B OBD-II Dongle 2.x/3.4.x. It has been rated as critical. This issue affects an unknown part of the component SSH Key. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

** DISPUTED ** Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation. NOTE: the vendor states "This was a flaw for the developer/debugging devices (again not possible in production versions)."

The weakness was released 08/23/2015 (Website). The advisory is shared at kb.cert.org. The identification of this vulnerability is CVE-2015-2906 since 04/03/2015. The attack may be initiated remotely. A simple authentication is necessary for exploitation. Neither technical details nor an exploit are publicly available.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-77382 and VDB-77383. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• C4B

Name

• OBD-II Dongle

Version

• 2.x
• 3.4.x

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion