Improper input validation in Juniper Mag Pcs360
CVE-2015-5369
Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.
EPSS: 0.018 (75.5th percentile) — read the EPSS interpretation.
Affected products
- Juniper Mag_pcs360
- Juniper Pcs6000
- Juniper Pcs6500
- Juniper Pulse_connect_secure — versions 5.1, 7.1, 7.4
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (x_refsource_CONFIRM)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2015-5369?
- CVE-2015-5369 is a vulnerability in Juniper Mag Pcs360, classified under CWE-17. Published 2015-08-11.
- Is CVE-2015-5369 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.