CVE-2016-2354

HIGH

Lemur Vehicle Monitors BlueDriver < 6.3.2 - Unauthenticated CAN Command Injection via Bluetooth Pairing

Title source: llm
STIX 2.1

Description

The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a CAN command to disrupt braking or steering.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/615456

Scores

CVSS v3 8.8
EPSS 0.0107
EPSS Percentile 60.8%
Attack Vector ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-284
Status published
Products (1)
lemurmonitors/bluedriver < 6.3.2
Published Apr 22, 2016
Tracked Since Feb 18, 2026