CVE-2015-2906 — Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation

Back Back to CVE browser

HIGH

Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation

Published Aug 23, 2015

9.0

HIGH

CVSS 2.0

EPSS 2.56%

Description

Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, store SSH private keys that are the same across different customers' installations, which makes it easier for remote attackers to obtain access by leveraging knowledge of a private key from another installation.

Affected products

Vendor Munic Product Mobile Devices (MDI) OBD-II dongles Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <2.x
- Version
  0
  Status
  affected
  Constraints
  <3.4.x

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Munic

Mobile Devices (MDI) OBD-II dongles

n/a

Version	Status	Constraints
0	affected	<2.x
0	affected	<3.4.x

Remediation

No remediation recorded yet.

Metrics

2.56% 0.02563

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.02563

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	2.56% (0.02563)	84.56th	v5 (v2026.06.15)
Jun 15, 2026	2.56% (0.02563)	83.03th	v5 (v2026.06.15)
Mar 17, 2025	0.64% (0.00635)	68.67th	v4 (v2025.03.14)
Dec 12, 2024	0.27% (0.00273)	68.87th	v3 (v2023.03.01)
Feb 8, 2024	0.27% (0.00273)	67.10th	v3 (v2023.03.01)
Mar 7, 2023	0.27% (0.00273)	62.93th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Feb 23, 2023	1.05% (0.01055)	52.04th	v2 (v2022.01.01)
Sep 19, 2022	1.06% (0.01061)	51.19th	v2 (v2022.01.01)
Apr 1, 2022	1.06% (0.01061)	49.19th	v2 (v2022.01.01)
Feb 4, 2022	1.06% (0.01061)	28.23th	v2 (v2022.01.01)

Weaknesses (0)

No CWE recorded.

References (2)

http://www.kb.cert.org/vuls/id/209512
Third Party AdvisoryUS Government Resource
https://www.usenix.org/conference/woot15/workshop-program/presentation/foster

Link	Providers	Tags
http://www.kb.cert.org/vuls/id/209512		Third Party AdvisoryUS Government Resource
https://www.usenix.org/conference/woot15/workshop-program/presentation/foster

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner certcc

Published Aug 23, 2015

Updated Aug 6, 2024

Reserved Apr 3, 2015

Link CVE-2015-2906

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2015-2906

Red Hat

Severity n/a

Public date n/a

Links CVE-2015-2906