CVE-2018-11478

Опубликовано: 30 мая 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 5.8

EPSS Низкий

Описание

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information from the car. This on-board diagnostics feature can also be used to send commands to the car (different for every vendor / car product line / car). No authentication is needed, which allows attacks from the local Wi-Fi network.

Ссылки

http://seclists.org/fulldisclosure/2018/May/66
Mailing List
Third Party Advisory
https://www.sec-consult.com/en/blog/advisories/unprotected-wifi-access-unencrypted-data-transfer-in-vgate-icar2-wifi-obd2-dongle/
Third Party Advisory
http://seclists.org/fulldisclosure/2018/May/66
Mailing List
Third Party Advisory
https://www.sec-consult.com/en/blog/advisories/unprotected-wifi-access-unencrypted-data-transfer-in-vgate-icar2-wifi-obd2-dongle/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:vgate:icar_2_wi-fi_obd2_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:vgate:icar_2_wi-fi_obd2:-:*:*:*:*:*:*:*

EPSS

Процентиль: 30%

0.00114

Низкий

8.8 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

GHSA-54qf-xm33-5gg7