CVE-2018-11477

Published: May 30, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered on Vgate iCar 2 Wi-Fi OBD2 Dongle devices. The data packets that are sent between the iOS or Android application and the OBD dongle are not encrypted. The combination of this vulnerability with the lack of wireless network protection exposes all transferred car data to the public.

Affected (1)

Products: Vgate: Icar 2 Wi Fi Obd2 Firmware

1 product

Icar 2 Wi Fi Obd2 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Vgate Icar 2 Wi Fi Obd2 Firmware	All versions

Running on/with	Platform Versions
Vgate Icar 2 Wi Fi Obd2	All versions

Related CWEs

Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (4)

http://seclists.org/fulldisclosure/2018/May/66

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.sec-consult.com/en/blog/advisories/unprotected-wifi-access-unencrypted-data-transfer-in-vgate-icar2-wifi-obd2-dongle/

Source: cve@mitre.org

Third Party Advisory

http://seclists.org/fulldisclosure/2018/May/66

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://www.sec-consult.com/en/blog/advisories/unprotected-wifi-access-unencrypted-data-transfer-in-vgate-icar2-wifi-obd2-dongle/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.