9
CVE-2015-2908
- EPSS 0.44%
- Veröffentlicht 23.08.2015 21:59:05
- Zuletzt bearbeitet 12.04.2025 10:46:40
- Quelle cret@cert.org
- CVE-Watchlists
- Unerledigt
LoginMobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, do not validate firmware updates, which allows remote attackers to execute arbitrary code by specifying an update server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mobile Devices ≫ C4 Obd-ii Dongle Firmware Version <= 3.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.44% | 0.631 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9 | 8 | 10 |
AV:N/AC:L/Au:S/C:C/I:C/A:C
|
CWE-345 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.