CVE-2015-2908

Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server.

Score

CVSS 2.0 9.0 Critical

Status

Modified - cret@cert.org

Published

2015-08-23

Last modified

2024-08-06

Weaknesses

CWE-345

Affected products

• C4 Obd-ii Dongle Firmware (Mobile Devices)
• Mobile Devices Mdi Obd-ii Dongles (Munic)

References

• http://www.kb.cert.org/vuls/id/209512
• https://www.usenix.org/conference/woot15/workshop-program/presentation/foster