CVE-2015-2906 json
Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private ke…
published 2015-08-23 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-2994
- cvss
- 9.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation.
Patch / fix
- Munic Mobile Devices (MDI) OBD-II dongles 2.x, 3.4.x
Exploit prediction
2.56% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- Munic Mobile Devices (MDI) OBD-II dongles
References
- usenix.org /conference/woot15/workshop-program/presentation/foster
-
kb.cert.org
/vuls/id/209512
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2015-2906
- NVD CVE-2015-2906
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.