EUVD-2015-2995

Malware in sbrugna...

EUVD-2015-2996

Malware in sbrugna...

SUSE CVE-2015-2908

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

CVE-2015-2908

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

Hardcoded credentials

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password...

Information disclosure

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private...

CVE-2015-2908

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server...

CVE-2015-2907

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password...

CVE-2015-2907

CVE-2015-2907 concerns the Mobile Devices (MDI) C4 OBD-II dongle family (firmware 2.x–3.4.x). The root cause is hard-coded SSH credentials (username/password) that enable remote attackers to gain access to affected devices. Impact described across sources includes unauthorized remote access; CERT...

CVE-2015-2906

Mobile Devices aka MDI C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private...

CVE-2015-2906

CVE-2015-2906 affects Mobile Devices (MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x. The root issue is that SSH private keys are identical across customer installations, allowing a remote attacker to leverage a known key to gain access to other installations. According to SUSE and CERT/CC-re...