Read the docs
TI-2017-07046 Aliases CVE-2017-9647GHSA-rc55-898m-34hx

Stack-based buffer overflow in Continental AG Infineon S-Gold 2

Priority LOW 30CWE-121Published · Updated

Key facts

Attack vector
Physical
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A Stack-Based Buffer Overflow issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010, Ford a limited number of P-HEV vehicles, Infiniti 2013 JX35, Infiniti 2014-2016 QX60, Infiniti 2014-2016 QX60 Hybrid, Infiniti 2014-2015 QX50, Infiniti 2014-2015 QX50 Hybrid, Infiniti 2013 M37/M56, Infiniti 2014-2016 Q70, Infiniti 2014-2016 Q70L, Infiniti 2015-2016 Q70 Hybrid, Infiniti 2013 QX56, Infiniti 2014-2016 QX 80, and Nissan 2011-2015 Leaf. An attacker with a physical connection to the TCU may exploit a buffer overflow condition that exists in the processing of AT commands. This may allow arbitrary code execution on the baseband radio processor of the TCU.

Why it matters now

EPSS 0.00541 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Continental AG Infineon S-Gold 2 (PMB 8876)Continental AG Infineon S-Gold 2 (PMB 8876)—No fix listedCNA
  • Continental AG Infineon S-Gold 2 (PMB 8876) Vendor— Affected Continental AG Infineon S-Gold 2 (PMB 8876) Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:h:infineon:s-gold_2_pmb_8876:-:*:*:*:*:*:*:*not specified by NVDVulnerableInfineon
  • cpe:2.3:h:infineon:s-gold_2_pmb_8876:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Infineon

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9647
  2. 2026-10-03 Alias added: GHSA-rc55-898m-34hx

References

Advisory 1

  • TI-2017-07034 Memory corruption in Continental AG Infineon S-Gold 2 CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences