CVE-2017-9758

Severity: high (CVSS 7.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-11-10 · updated 2026-06-17
Weakness: CWE-295

Description

Savitech driver packages for Windows silently install a self-signed certificate into the Trusted Root Certification Authorities store, aka "Inaudible Subversion."

Affected products

Savitech-Ic Savitech Driver: before 2.8.0.3 — fixed in 2.8.0.3

How to fix

Upgrade to a fixed version: Savitech-Ic Savitech Driver 2.8.0.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/101700
https://community.rsa.com/community/products/netwitness/blog/2017/10/27/inaudible-subversion-did-your-hi-fi-just-subvert-your-pc
https://www.kb.cert.org/vuls/id/446847
https://zeroday.hitcon.org/vulnerability/ZD-2017-00386
http://www.securityfocus.com/bid/101700
https://community.rsa.com/community/products/netwitness/blog/2017/10/27/inaudible-subversion-did-your-hi-fi-just-subvert-your-pc
https://www.kb.cert.org/vuls/id/446847
https://zeroday.hitcon.org/vulnerability/ZD-2017-00386

Get alerted when CVE-2017-9758 or the next vulnerability affects your stack