C4B OBD-II Dongle 2.x/3.4.x SSH Default Credentials weak authentication : 8/24/2015 3:38:24 AM
 | This eBook shows you how common web marketing tactics map to their mobile counterparts, including a "this = that" chart of web to app equivalents. From our sponsors  |
| Vulnerability Advisories |
| Vulnerabilities of scip VulDB |
C4B OBD-II Dongle 2.x/3.4.x SSH Default Credentials weak authentication
8/22/2015 7:00:00 PM
General
scipID: 77382
Affected: C4B OBD-II Dongle 2.x/3.4.x
Published: 08/23/2015
Risk: critical
Created: 08/24/2015
Entry: 66.8% complete
Summary
A vulnerability classified as critical has been found in C4B OBD-II Dongle 2.x/3.4.x. Affected is an unknown function of the component SSH. The manipulation with an unknown input leads to a weak authentication vulnerability (default credentials). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:
- DISPUTED ** Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password. NOTE: the vendor states “This was a flaw for the developer/debugging devices (again not possible in production versions).”
The weakness was disclosed 08/23/2015. This vulnerability is traded as CVE-2015-2907. It is possible to launch the attack remotely. The exploitation doesn’t require any form of authentication. The technical details are unknown and an exploit is not available.
The real existence of this vulnerability is still doubted at the moment.
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
CVSS
Base Score: 6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P) [?]
Temp Score: 6.8 (CVSS2#E:ND/RL:ND/RC:ND) [?]
CPE
Exploiting
Class: Weak authentication
Local: No
Remote: Yes
Availability: No
Countermeasures
Recommended: no mitigation known
0-Day Time: 0 days since found
Timeline
08/23/2015 | Advisory disclosed
08/24/2015 | VulDB entry created
08/24/2015 | VulDB entry updated
Sources
Disputed: Yes
CVE: CVE-2015-2907 (mitre.org) (nvd.nist.org) (cvedetails.com)
You are receiving this email because you subscribed to this feed at feedmyinbox.com
If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions
