CVE-2015-2906: Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and othe...

Security readout for executives and security teams

Some MDI C4 OBD-II vehicle dongles used the same SSH private keys across customer deployments. If an attacker knows the shared key from one installation, it may help them access other deployed dongles. The source bundle does not provide CVSS scoring, a confirmed patch, or confirmed active exploitation. Exposure is most likely in organizations operating or supporting fleets that used MDI C4 OBD-II dongles on firmware 2.x or 3.4.x. Actual remote exposure depends on whether SSH or device management paths are reachable; the bundle does not specify network topology or deployment controls. Prioritize discovery if the organization used these vehicle dongles, especially in fleet, insurance, or telematics programs. Business urgency is driven by asset exposure and manageability, because the bundle lacks severity scoring, patch confirmation, and exploitation evidence. Mitigation focus: Inventory MDI C4 OBD-II dongles and confirm firmware versions.; Check Munic, Mobile Devices, Metromile, or CERT guidance for supported remediation.; Replace affected dongles if no trusted vendor remediation is available..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.