7.5high
CVE-2017-9663
An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 65%
Public exploits
0
none known
Summary
An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow a remote attacker to access an encryption key that is stored in cleartext in memory.
Exploit prediction (EPSS)
1.07% probability of exploitation in the next 30 days, higher than 65% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- n/a General Motors and Shanghai OnStar (SOS) iOS Client
Classification
- Weakness
- CWE-312 Cleartext Storage of Sensitive Information
References
- ics-cert.us-cert.gov /advisories/ICSA-17-234-04 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/102481 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-9663
- NVD: CVE-2017-9663
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.