Skip to content
CVE Tracker
Back

CVE-2017-10620

SRX Series: Antivirus updates are downloaded without verification

High7.4EPSS 0.57%
Published
Updated
Reserved
Assigned by
juniper

Description

Juniper Networks Junos OS on SRX series devices do not verify the HTTPS server certificate before downloading anti-virus updates. This may allow a man-in-the-middle attacker to inject bogus signatures to cause service disruptions or make the device not detect certain types of attacks. Affected Junos OS releases are: 12.1X46 prior to 12.1X46-D71; 12.3X48 prior to 12.3X48-D55; 15.1X49 prior to 15.1X49-D110;

Scores

CVSS scores of CVE-2017-10620, by who scored it
Scored byCVSSScoreVector
juniperCNA (assigner)3.0High7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
NVDNVD · Modified3.0High7.4CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS (exploitation in 30 days)
0.57% · top 53% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.

Weakness

Affected products

  • Juniper Networks · Junos OS

    • affected 12.1X46 prior to 12.3X46-D71
    • affected 12.3X48 prior to 12.3X48-D55
    • affected 15.1X49 prior to 15.1X49-D110

What to do

Workaround: There are no viable workarounds for this issue. It is good security practice to limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the device from trusted, administrative networks or hosts.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .