Yes, the OBD-II port is a real attack surface, because it connects straight to the vehicle's diagnostic network, and the original specifications lack authentication and authorization. Plugged in devices can be a risk too. The practical defence is to control who has physical access and which devices stay connected.
What the port is
OBD-II became mandatory for US passenger cars and light petrol trucks in 1996, after California adopted the specification. The European equivalent, EOBD, applied to petrol cars first registered from 1 January 2001 and diesel cars from 1 January 2004. Both use the SAE J1962 connector, a 16 pin plug, and the same signal protocols.
ISO 15765-4 CAN is one of five permitted protocols, and the reference page says all vehicles sold in the US from 2008 had to implement CAN. So a device on the port is usually talking onto a CAN network.
What the record says about risk
The reference page reports that in 2012 researchers from two US universities gained control of many vehicle components through the interface and uploaded new firmware into engine control units. It attributes this partly to the lack of authentication and authorization in the specifications. It also reports thieves using OBD reprogramming devices to steal cars without a key.
Treat these as reported by a secondary source. They show the category of risk, not the exposure of any specific model today.
The dongle problem
Scan tools and adapters plug into the port and often connect over Bluetooth, Wi-Fi or USB. Many are built on ELM327 or STN interpreter chips. Telematics devices and insurance data loggers also sit there. Each one is a small computer with its own firmware and its own wireless link, parked on a trusted network.
Some apps can reset fault codes. The same page warns that this can lead to engine damage if underlying problems are ignored.
What to do
For owners:
- Unplug dongles you are not actively using.
- Buy adapters from sellers who publish firmware update information.
- Prefer a wired connection when you only need a one time check.
For fleets:
- Keep an inventory of every device on the port, with an owner for each.
- Ask your telematics provider how the device authenticates to its cloud and how its firmware is updated.
- Treat unknown devices found during inspections as an incident to investigate.
For manufacturers, the port belongs in the threat analysis, with gateways filtering what a diagnostic tester can send and what services are reachable, as covered in the UDS post.
Reading the risk fairly
The port is not a flaw by itself. It exists so repairs and emissions checks can happen. The risk comes from what a connected device or a person with brief access can do once on the network. That is why gateways, session controls and device inventories matter more than the connector itself. Keep that framing when you brief non technical colleagues.
Quick check
Can I just cover or disable the port?
Not safely as a general rule. Inspections and repairs rely on it. Control the devices and access instead.
Sources
Last reviewed: 19 October 2026.
