CVE-2018-11478 : Security Advisory and Response

Vulnerability in Vgate iCar 2 Wi-Fi OBD2 Dongle devices

Understanding CVE-2018-11478

What is CVE-2018-11478?

A vulnerability has been identified in Vgate iCar 2 Wi-Fi OBD2 Dongle devices, allowing unauthorized access via the local Wi-Fi network due to lack of authentication.

The Impact of CVE-2018-11478

The vulnerability exposes the OBD port used for collecting car data to potential attacks, compromising the security and privacy of the vehicle and its occupants.

Technical Details of CVE-2018-11478

Vulnerability Description

The issue arises from the lack of authentication on the OBD port, enabling attackers on the local Wi-Fi network to send commands to the car without authorization.

Affected Systems and Versions

Product: Vgate iCar 2 Wi-Fi OBD2 Dongle
Vendor: Vgate
Versions: All versions

Exploitation Mechanism

Attackers can exploit the vulnerability by connecting to the unsecured local Wi-Fi network and sending unauthorized commands to the car through the OBD port.

Mitigation and Prevention

Immediate Steps to Take

Disconnect the Vgate iCar 2 Wi-Fi OBD2 Dongle from the OBD port when not in use.
Avoid using the device on public or unsecured Wi-Fi networks.
Regularly check for firmware updates from the vendor.

Long-Term Security Practices

Implement strong encryption protocols for wireless communication.
Consider using a firewall to restrict unauthorized access to the OBD port.

Patching and Updates

Apply firmware updates provided by Vgate to address the authentication vulnerability.