CVE-2015-2908
UnknownEPSS 1.78%
Last modified
CVE-2015-2908 is a vulnerability of currently unknown severity. Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server.. EPSS estimates a 1.78% chance of exploitation in the next 30 days.
Description
Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mobile Devices | C4 Obd-Ii Dongle Firmware | <= 3.4 |
References
- http://www.kb.cert.org/vuls/id/209512Third Party Advisory, US Government Resource
- http://www.kb.cert.org/vuls/id/209512Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-2908?
Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server.
How severe is CVE-2015-2908?
Severity scoring for CVE-2015-2908 is pending analysis. The EPSS model estimates a 1.78% probability of exploitation in the next 30 days.
How do I fix CVE-2015-2908?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-2902HP ArcSight SmartConnectors before 7.1.6 do not verify X.509…
- CVE-2015-2903The CWSAPI SOAP service in HP ArcSight SmartConnectors befor…
- CVE-2015-2904Actiontec GT784WN modems with firmware before NCS01-1.0.13 h…
- CVE-2015-2905Cross-site request forgery (CSRF) vulnerability on Actiontec…
- CVE-2015-2906Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x…
- CVE-2015-2907Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x…
- CVE-2015-2909Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, a…9.8
- CVE-2015-2912The JSONP endpoint in the Studio component in OrientDB Serve…
- CVE-2015-2913server/network/protocol/http/OHttpSessionManager.java in the…
- CVE-2015-2914Securifi Almond devices with firmware before AL1-R201EXP10-L…
- CVE-2015-2915Securifi Almond devices with firmware before AL1-R201EXP10-L…
- CVE-2015-2916Cross-site request forgery (CSRF) vulnerability on Securifi …
Are you affected by CVE-2015-2908?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST