CVE-2017-3891: blackberry qnx_software_development_platform
Vulnerability summary
CVE-2017-3891 is a critical (CVSS 9.6) vulnerability in blackberry qnx_software_development_platform. EPSS estimates a 1.28% chance of exploitation in the next 30 days, higher than 69.5% of scored vulnerabilities.
Timeline
- 14-11-2017PublishedVulnerability first disclosed.
- 22-08-2025Last modifiedVulnerability information updated.
Description
In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on other QNX nodes regardless of permissions by executing commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST9.6CriticalCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
1.28%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
-0.01 pp
From 1.28% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-923Improper Restriction of Communication Channel to Intended EndpointsThe product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Blackberry2 products
1 vendor · 2 products
References
2 links- support.blackberry.com/kb/articleDetail?articleNumber=000046674X Refsource CONFIRMMitigationVendor Advisory