CVE-2015-2907 in OBD-II Dongle
Summary
by MITRE
** DISPUTED ** Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password. NOTE: the vendor states "This was a flaw for the developer/debugging devices (again not possible in production versions)."
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/07/2024
The vulnerability identified as CVE-2015-2907 affects Mobile Devices (MDI) C4 OBD-II dongles running firmware versions 2.x and 3.4.x, which are deployed in automotive telematics systems including the Metromile Pulse platform. This represents a critical security flaw that stems from the inclusion of hardcoded credentials within the device firmware, creating a persistent backdoor that undermines the security posture of connected vehicle systems. The issue manifests as a failure to implement proper authentication mechanisms, leaving devices vulnerable to unauthorized access through well-known username and password combinations that are embedded directly within the software rather than being dynamically generated or securely stored.
From a technical perspective, this vulnerability constitutes a classic implementation of CWE-798, which specifically addresses the use of hardcoded credentials in software systems. The presence of hardcoded SSH credentials in production devices represents a fundamental flaw in the security architecture, as it eliminates the possibility of credential rotation and creates a universal access point that remains constant across all affected deployments. The attack surface is particularly concerning given that these devices operate in automotive environments where they may be exposed to physical access or network-based attacks, and the fact that the vendor acknowledges this as a debugging feature that should not have been present in production systems indicates poor security testing and deployment practices.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it provides attackers with a persistent entry point into vehicle telematics systems that may contain sensitive operational data or enable control over vehicle functions. Attackers leveraging these hardcoded credentials can potentially access vehicle diagnostics information, location data, or even manipulate connected vehicle systems, representing a significant risk to both individual privacy and vehicle safety. The vulnerability's impact is amplified by the widespread deployment of these devices across various automotive platforms, meaning that a single flaw can affect numerous vehicles and potentially create a scalable attack vector against automotive telematics infrastructure.
The security implications of this vulnerability align with several ATT&CK framework techniques including T1078 for valid accounts and T1046 for network service scanning, as attackers can systematically target these devices using known credential combinations to establish persistent access. The vendor's acknowledgment that this was intended for developer and debugging purposes but was inadvertently included in production builds demonstrates a failure in security assurance processes and highlights the importance of proper code review and deployment validation. Organizations should implement immediate mitigations including network segmentation to isolate affected devices, monitoring for unauthorized SSH access attempts, and ensuring that all affected devices are updated to versions that remove the hardcoded credentials. The incident underscores the critical need for secure development practices and proper security testing of embedded automotive systems, particularly those handling sensitive operational data.