Read the docs
TI-2017-07034 Aliases CVE-2017-9633GHSA-8x7q-x834-pj4x

Memory corruption in Continental AG Infineon S-Gold 2

Priority MEDIUM 44CWE-119Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02238 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Continental AG Infineon S-Gold 2 (PMB 8876)Continental AG Infineon S-Gold 2 (PMB 8876)—No fix listedCNA
  • Continental AG Infineon S-Gold 2 (PMB 8876) Vendor— Affected Continental AG Infineon S-Gold 2 (PMB 8876) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:h:infineon:s-gold_2_pmb_8876:-:*:*:*:*:*:*:*not specified by NVDVulnerableInfineon
  • cpe:2.3:h:infineon:s-gold_2_pmb_8876:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Infineon

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9633
  2. 2026-10-03 Alias added: GHSA-8x7q-x834-pj4x

References

Advisory 1

  • TI-2017-07046 Stack-based buffer overflow in Continental AG Infineon S-Gold 2 CVSS 3.0MEDIUM 6.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences