Vulnerability in Juniper Srx300
CVE-2017-10606
Version 4.40 of the TPM (Trusted Platform Module) firmware on Juniper Networks SRX300 Series has a weakness in generating cryptographic keys that may allow an attacker to decrypt sensitive information in SRX300 Series products. The TPM is used in the SRX300 Series to encrypt sensitive configuration data. While other products also ship with a TPM, no other products or platforms are affected by this vulnerability. Customers can confirm the version of TPM firmware via the 'show security tpm status' command. This issue was discovered by an external security researcher. No other Juniper Networks products or platforms are affected by this issue.
EPSS: 0.003 (24.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.4 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Juniper Srx300
- Juniper Srx320
- Juniper Srx340
- Juniper Srx345
- Juniper Trusted_platform_module_firmware — versions 4.40
- Juniper Networks Junos Os — versions 15.1X49 prior to TPM firmware version 4.43
References
- sirt@juniper.net (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-10606?
- CVE-2017-10606 is a medium-severity vulnerability in Juniper Srx300. CVSS score: 4.4/10. Published 2017-10-13.
- How severe is CVE-2017-10606?
- Medium severity. CVSS v3 base score is 4.4 out of 10.