CVE-2015-2907 json
Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH c…
published 2015-08-23 11 y ago modified 2026-06-17 4 mo ago also EUVD-2015-2995
- cvss
- 9.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.6%
- EPSS 2.6% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password.
Patch / fix
- Munic Mobile Devices (MDI) OBD-II dongles 2.x, 3.4.x
Exploit prediction
2.56% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Affected products
- Munic Mobile Devices (MDI) OBD-II dongles
References
- usenix.org /conference/woot15/workshop-program/presentation/foster
-
kb.cert.org
/vuls/id/209512
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2015-2907
- NVD CVE-2015-2907
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.