CVE-2015-2907: Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and othe...

Security readout for executives and security teams

CVE-2015-2907 is a hardcoded SSH credential issue in Mobile Devices/MDI C4 OBD-II dongles, including Metromile Pulse deployments. If an attacker can reach the device’s SSH service and knows the built-in credentials, they may gain access. The provided sources do not include a CVSS score or confirmed active exploitation. Exposure is most likely in fleets, insurers, or consumers using MDI C4-based OBD-II telematics dongles, including Metromile Pulse. Risk depends on whether SSH is reachable through cellular, local, or management networks. The provided evidence does not identify all downstream products. Treat as high priority where affected dongles are deployed at scale or connected to operational fleet processes. The business issue is uncontrolled remote administrative access to vehicle-connected telematics hardware, with incomplete public remediation detail in the provided sources. Mitigation focus: Inventory OBD-II dongles and identify MDI C4 firmware 2.x or 3.4.x.; Check CERT and vendor guidance for replacement, firmware updates, or decommissioning instructions.; Restrict SSH and management access to trusted networks only..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.