CVE-2015-2906 Information

Description

LICENSE README.md cvefilelist cvelist nvdcve nvdpages.sh scripts test-CVE-2017-1882.markdown test-CVE-2017-18822.markdown tmpvendorlinks DISPUTED LICENSE README.md cvefilelist cvelist nvdcve nvdpages.sh scripts test-CVE-2017-1882.markdown test-CVE-2017-18822.markdown tmpvendorlinks Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x as used in Metromile Pulse and other products store SSH private keys that are the same across different customers’ installations which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation. NOTE: the vendor states \This was a flaw for the developer/debugging devices (again not possible in production versions).\

Reference

http://www.kb.cert.org/vuls/id/209512 http://www.kb.cert.org/vuls/id/CKIG-9ZAQGX https://www.usenix.org/conference/woot15/workshop-program/presentation/foster