Skip to content
Fencer Vulns
high 8.8

CVE-2017-9633 json

An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PM…

published 2017-08-07 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-18564

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-17-208-01 updated cvss 8.8

Continental AG Infineon S-Gold 2 (PMB 8876)

  • Continental AG BMW 2009-2010 Continental AG Ford program to update 2G modems has been active since 2016 and impact is restricted to the limited numbe Continental AG Infiniti JX35 2013 Continental AG Infiniti M37/M56 2013 Continental AG Infiniti Q70 2014-2016 Continental AG Infiniti Q70 Hybrid 2015-2016
    +8 more products
    Continental AG Infiniti Q70L 2014-2016 Continental AG Infiniti QX50 2014-2015 Continental AG Infiniti QX50 Hybrid 2014-2015 Continental AG Infiniti QX56 2013 Continental AG Infiniti QX60 2014-2016 Continental AG Infiniti QX60 Hybrid 2014-2016 Continental AG Infiniti QX80 2014-2016 Continental AG Nissian Leaf 2011-2015
    affected: vendor fix, mitigation “Continental has validated the reported vulnerabilities but has not yet identified a mitigation plan.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

2.24% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.0 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 8.3 AV:A/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • n/a Continental AG Infineon S-Gold 2 (PMB 8876)

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.