Vulnerability in Blackberry Qnx Momentics
CVE-2021-32025
An elevation of privilege vulnerability in the QNX Neutrino Kernel of affected versions of QNX Software Development Platform version(s) 6.4.0 to 7.0, QNX Momentics all 6.3.x versions, QNX OS for Safety versions 1.0.0 to 1.0.2, QNX OS for Safety versions 2.0.0 to 2.0.1, QNX for Medical versions 1.0.0 to 1.1.1, and QNX OS for Medical version 2.0.0 could allow an attacker to potentially access data, modify behavior, or permanently crash the system.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (6.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Blackberry Qnx Momentics — versions 6.3.0, 6.3.2
- Blackberry Qnx OS For Medical — versions 2.0.0
- Blackberry Qnx OS For Safety
- Blackberry Qnx Software Development Platform
- Blackberry Qnx Software Development Platform (Sdp), OS For Medical (Qosm), And Safety (Qos) — versions QNX SDP 6.4.0 to 7.0, QNX Momentics all 6.3.x versions, QNX OS for Safety versions 1.0.0 to 1.0.2 safety products compliant with IEC 61508 and/or ISO 26262
Weakness classification (CWE)
References
- support.blackberry.com/kb/articleDetail (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-32025?
- CVE-2021-32025 is a high-severity vulnerability in Blackberry Qnx Momentics, classified under CWE-368. CVSS score: 8.1/10. Published 2022-03-10.
- How severe is CVE-2021-32025?
- High severity. CVSS v3 base score is 8.1 out of 10.