CVE-2017-14937 describes a vulnerability in airbag control units (PCUs) of unspecified passenger vehicles manufactured in 2014 or later. It allows for the predictable detonation of airbags due to a weak Security Access (SA) algorithm with only 256 possible key pairs and no rate limiting on authentication attempts. The vulnerability has a CVSS score of 4.7 (Medium), requiring local access to the CAN bus and low attack complexity to achieve high impact, specifically injury to vehicle occupants. While not actively exploited in the wild, a Metasploit module exists to check for and prepare pyrotechnic devices, indicating proof-of-concept exploit code availability. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2014CPE matchmatch criteria | cpe:2.3:h:pcu:pcu:2014:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.