PT-2017-16160 · Blackberry · Qnx Sdp

Published 2017-11-14 · Updated 2025-08-22 · CVE-2017-3891

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlackBerry QNX Software Development Platform (SDP) version 6.6.0

Description The issue is related to an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled. This could allow an attacker to access local and remote files or take ownership of files on other QNX nodes, regardless of permissions. The attacker can execute commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node.

Recommendations For BlackBerry QNX Software Development Platform (SDP) version 6.6.0, consider disabling QNet or restricting its use to minimize the risk of exploitation until a patch is available. Restrict access to sensitive files and nodes to prevent unauthorized access.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-923

Related Identifiers

CVE-2017-3891

Affected Products

Qnx Sdp

References · 5

• https://osv.dev/vulnerability/CVE-2017-3891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3891 · Security Note
• http://support.blackberry.com/kb/articleDetail?articleNumber=000046674 · Vendor Advisory
• https://t.me/cveNotify/133177 · Telegram Post
• https://midnightbluelabs.com/blog/2017/12/8/elevation-of-privilege-vulnerability-in-qnx-qnet · Note