PatchTheCVECVE-2017-14937: The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA)
CVE-2017-14937 is a medium-severity flaw (CVSS 4.7) affecting pcu. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (or the OBD connector). This affects the airbag control units (aka pyrotechnical control units or PCUs) of unspecified passenger vehicles manufactured in 2014 or later, when the ignition is on and the speed is less than 6 km/h. Specifically, there are only 256 possible key pairs, and authentication attempts ha
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 4.7 (Medium) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.0% (top 37%) |
| CISA exploited list | No |
| Weakness | CWE-327 |
| Published | 2017-10-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-14937?
pcu: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2017-14937 being exploited?
CVE-2017-14937 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-14937 affect?
CVE-2017-14937 affects pcu. Severity is medium (CVSS 4.7). The airbag detonation algorithm allows injury to passenger-car occupants via predictable Security Access (SA) data to the internal CAN bus (or the OBD connector). This affects the airbag control units (aka pyrotechnical control units or PCU
How urgent is CVE-2017-14937?
Priority 32/100. No elevated risk signals yet.