CVE-2017-9663

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An Cleartext Storage of Sensitive Information issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow a remote attacker to access an encryption key that is stored in cleartext in memory.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	General Motors and Shanghai OnStar (SOS) iOS Client	General Motors and Shanghai OnStar (SOS) iOS Client

References

http://www.securityfocus.com/bid/102481Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-234-04Mitigation, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/102481Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-234-04Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jan 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-96649.8In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker CVE-2017-96686.1In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a user group, there is no XSS filtering, resulting in storage-type XSS generatio CVE-2017-96697.8A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution by CVE-2017-96707.8An uninitialized stack variable vulnerability in load_tic_series() in set.c in gnuplot 5.2.rc1 allows an attacker to cause Denial of Service CVE-2017-96717.8A heap overflow in apk (Alpine Linux's package manager) allows a remote attacker to cause a denial of service, or achieve code execution, by CVE-2017-96738.8In SimpleCE 2.3.0, a CSRF vulnerability can be exploited to add an administrator account (via the index.php/user/new URI) or change its sett CVE-2017-96745.4In SimpleCE 2.3.0, an authenticated XSS vulnerability was found on index.php/content/text/1?return_url=[XSS] exploitable as a regular or adm CVE-2017-96757.5On D-Link DIR-605L devices, firmware before 2.08UIBetaB01.bin allows an unauthenticated GET request to trigger a reboot.CVE-2017-96764.7In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can o CVE-2017-96777.8In all Qualcomm products with Android releases from CAF using the Linux kernel, in function msm_compr_ioctl_shared, variable "ddp->params_le CVE-2017-96787.8In all Qualcomm products with Android releases from CAF using the Linux kernel, in a video driver, memory corruption can potentially occur d CVE-2017-96797.5In all Qualcomm products with Android releases from CAF using the Linux kernel, if a userspace string is not NULL-terminated, kernel memory