CVE-2015-2907

Опубликовано: 23 авг. 2015

Источник: nvd

CVSS2: 9

EPSS Низкий

Описание

Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password.

Комментарий

CWE-798: Use of Hard-coded Credentials

Ссылки

http://www.kb.cert.org/vuls/id/209512
Third Party Advisory
US Government Resource
https://www.usenix.org/conference/woot15/workshop-program/presentation/foster
http://www.kb.cert.org/vuls/id/209512
Third Party Advisory
US Government Resource
https://www.usenix.org/conference/woot15/workshop-program/presentation/foster

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:mobile_devices:c4_obd-ii_dongle_firmware:*:*:*:*:*:*:*:*

Версия до 3.4 (включая)

EPSS

Процентиль: 70%

0.00648

Низкий

9 Critical

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-36vf-gm3g-hgwj

github

больше 3 лет назад

** DISPUTED ** Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password. NOTE: the vendor states "This was a flaw for the developer/debugging devices (again not possible in production versions)."