1. Home
  2. CVE Database
  3. CVE-2017-10620
HIGH · 7.4

CVE-2017-10620

Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures...

Vulnerability Description

Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures to cause service disruptions or make the device not detect certain types of attacks. Affected Junos OS releases are: 12.1X46 prior to 12.1X46-D71; 12.3X48 prior to 12.3X48-D55; 15.1X49 prior to 15.1X49-D110;

CVSS Score

7.4

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
JuniperJunos12.1x46
JuniperSrx100-
JuniperSrx110-
JuniperSrx1400-
JuniperSrx1500-
JuniperSrx210-
JuniperSrx220-
JuniperSrx240-
JuniperSrx300-
JuniperSrx320-
JuniperSrx340-
JuniperSrx3400-
JuniperSrx345-
JuniperSrx3600-
JuniperSrx4100-
JuniperSrx4200-
JuniperSrx5400-
JuniperSrx550-
JuniperSrx5600-
JuniperSrx5800-

Related Weaknesses (CWE)

CWE-295

References

FAQ

What is CVE-2017-10620?

CVE-2017-10620 is a vulnerability with a CVSS score of 7.4 (HIGH). Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures...

How severe is CVE-2017-10620?

CVE-2017-10620 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-10620?

Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Srx100, Juniper Srx110, Juniper Srx1400, Juniper Srx1500.