CVE-2018-11476

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a password. This enables anyone within the range of the WLAN to connect to the network without authentication...

CVE-2018-11478

The CVE affects the Vgate iCar 2 Wi‑Fi OBD2 Dongle where the OBD port can be accessed over a local Wi‑Fi network without authentication, enabling unauthenticated access to the car data bus (e.g., CAN). The issue arises from missing authentication for OBD communications; impact is exposure of meas...

CVE-2018-11476: Missing Authentication for Critical Function

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The dongle opens an unprotected wireless LAN that cannot be configured with encryption or a password. This enables anyone within the range of the WLAN to connect to the network without authentication...

PT-2018-10596

Name of the Vulnerable Software and Affected Versions Vgate iCar 2 Wi-Fi OBD2 Dongle affected versions not specified Description An issue was discovered where the data packets sent between the iOS or Android application and the OBD dongle are not encrypted. This, combined with the lack of wireles...

PT-2018-10595

Name of the Vulnerable Software and Affected Versions Vgate iCar 2 Wi-Fi OBD2 Dongle affected versions not specified Description The issue concerns an unprotected wireless LAN in the Vgate iCar 2 Wi-Fi OBD2 Dongle devices. This LAN cannot be configured with encryption or a password, allowing anyo...

PT-2018-10597

Name of the Vulnerable Software and Affected Versions Vgate iCar 2 Wi-Fi OBD2 Dongle affected versions not specified Description An issue was discovered where the OBD port on Vgate iCar 2 Wi-Fi OBD2 Dongle devices can be used to receive measurement data and debug information from the car, as well...

CVE-2018-11478: Improper Authentication

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The OBD port is used to receive measurement data and debug information from the car. This on-board diagnostics feature can also be used to send commands to the car different for every vendor / car product line / car. No...

CVE-2018-11477: Cleartext Transmission of Sensitive Information

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the...

Vgate iCar2 WiFi OBD2 Dongle Inadequate Access Protections

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Unprotected WiFi access & Unencrypted data transfer product: Vgate iCar 2 WiFi OBD2 Dongle vulnerable version: Vgate iCar 2 WiFi OBD2 Dongle fixed version: - CVE number:...

OBD2-ELM327. Car Diagnostics - Corrupted files, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application OBD2-ELM327. Car Diagnostics published at the 'play' market has multiple vulnerabilities...

OBD2 Codes Fix Free - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application OBD2 Codes Fix Free published at the 'play' market has multiple vulnerabilities...

OBD2 port Lookup - Car's DLC - External URLs, SD-card access, Suspicious files vulnerabilities

HackApp vulnerability scanner discovered that application OBD2 port Lookup - Car's DLC published at the 'play' market has multiple vulnerabilities...

Mobile Devices C4 OBD2 Dongle Privilege Access Vulnerability (CNVD-2015-05627)

The Mobile Devices aka MDI C4 OBD2 Dongle is a programmable OBD2 solution from the French company Mobile Devices. A security vulnerability exists in the Mobile Devices C4 OBD2 Dongle that arises from different user installers storing the same SSH private key. A remote attacker could exploit the...