CVE-2016-2354: Lemurmonitors Bluedriver

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a CAN command to disrupt braking or steering.

Affected products

• Lemurmonitors Bluedriver: up to and including 6.3.2

Published 2016-04-22. Last modified 2026-06-17.