8 High
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:P/I:C/A:C
8.8 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
67.8%
The Lemur Vehicle Monitors BlueDriver is an aftermarket automotive device that connects to a vehicleβs OBD-II port and provides information about the vehicleβs performance. The BlueDriver does not require a PIN for Bluetooth access, which allows anyone in range to send arbitrary commands to the vehicleβs CAN bus.
CWE-306: Missing Authentication for Critical Function - CVE-2016-2354
The CERT Coordination Center has determined that the Lemur BlueDriver does not require a PIN to connect to it via Bluetooth. This allows anyone within Bluetooth range to access standard OBD-II diagnostic information about the car, including gas mileage, Diagnostic Trouble codes, speed, emissions, etc. It also allows an attacker to create a serial connection directly to the CAN (Controller Area Network) bus in the vehicle. Any valid CAN command can be sent to the vehicle. Depending on the vehicle, this may allow attackers to affect safety critical systems such as steering or braking.
The attack is limited to short (Bluetooth) range, but it could be launched from a compromised device inside the car (e.g., cell phone). Depending on the car make and model, impact could range from information disclosure to life-threatening.
Apply an Update
Lemur Vehicle Monitors has released a firmware update to address this vulnerability:
_BlueDriver scan tool users can update their sensor Firmware (F/W) by opening
their BlueDriver App and tapping βMoreβ > βUpdate Sensor F/Wβ > βCheck for
Updatesβ and following the instructions.
The latest F/W for BlueDriver limits Bluetooth discoverability to 1 minute
after plug in. This added feature limits discovering (and then pairing) to
your BlueDriver to those who first plug in the sensor_.
For clarification, the vendor has stated that discoverability is now limited to only when the device is plugged in, not every time the vehicle is turned on.
615456
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: February 03, 2016 Updated: April 07, 2016
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | 8 | AV:A/AC:L/Au:N/C:P/I:C/A:C |
Temporal | 7.6 | E:F/RL:U/RC:C |
Environmental | 6.7 | CDP:H/TD:M/CR:L/IR:H/AR:L |
Thanks to Dan Klinedinst of the CERT/CC for reporting this vulnerability.
This document was written by Dan Klinedinst.
CVE IDs: | CVE-2016-2354 |
---|---|
Date Public: | 2016-04-07 Date First Published: |
8 High
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:P/I:C/A:C
8.8 High
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
67.8%