Read the docs
TI-2015-02566 Aliases CVE-2015-2906GHSA-pwmv-666f-8qgp

Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in…

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation.

Why it matters now

EPSS 0.02563 85th percentileScored 2026-11-07
Fix Fixed Mobile Devices (MDI) OBD-II dongles (Munic): 2.x, 3.4.x

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MunicMobile Devices (MDI) OBD-II donglesbefore 2.x; before 3.4.x2.x, 3.4.xPatch availableCNA
  • Mobile Devices (MDI) OBD-II dongles VendorMunic Affected before 2.x; before 3.4.x Fixed in 2.x, 3.4.x Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:mobile_devices:c4_obd-ii_dongle_firmware:*:*:*:*:*:*:*:*up to 3.4VulnerableMunic
  • cpe:2.3:o:mobile_devices:c4_obd-ii_dongle_firmware:*:*:*:*:*:*:*:* Versions up to 3.4 Vulnerable ·Munic

Remediation

  • Fix · CNA Mobile Devices (MDI) OBD-II dongles (Munic) Fixed in 2.x, 3.4.x

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Munic Mobile Devices (MDI) OBD-II dongles 2.x, 3.4.x

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2015-02567 Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in…Priority MEDIUM 44
    • TI-2015-02568 Insufficient verification of data authenticity in Munic Mobile Devices OBD-II donglesPriority MEDIUM 42
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-2906
  2. 2026-10-03 Alias added: GHSA-pwmv-666f-8qgp

References

Advisory 1

Other 1

  • TI-2015-02567 Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in… CVSS 2.0HIGH 9.0
  • TI-2015-02568 Insufficient verification of data authenticity in Munic Mobile Devices OBD-II dongles CVSS 2.0HIGH 9.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences