CVE-2017-3891 Privilege escalation in QNX Software Development Platform (QNX SDP)

Critical 9.6 Published 14 Nov 2017 Updated 22 Aug 2025

An attacker with access to a secondary QNet node can escalate privileges to access or modify files on other QNX nodes regardless of permissions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-3891?

CVE-2017-3891 is a critical vulnerability in BlackBerry QNX Software Development Platform (QNX SDP), published on 14 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In BlackBerry QNX Software Development Platform (SDP) 6.6.0, an elevation of privilege vulnerability in the default configuration of the QNX SDP with QNet enabled on networks comprising two or more QNet nodes could allow an attacker to access local and remote files or take ownership of files on other QNX nodes regardless of permissions by executing commands targeting arbitrary nodes from a secondary QNX 6.6.0 QNet node.

Weakness: CWE-863, CWE-923

Which versions are affected by CVE-2017-3891?

It affects 1 product.

Products include Blackberry Qnx Software Development Platform.

How do I fix CVE-2017-3891?

No fix has been published for CVE-2017-3891 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-3891 being exploited?

There is no known exploitation of CVE-2017-3891 in the wild and no public exploit code.

Sources

Also known as GHSA-jcf6-fg3w-j8ph.