High severity · published Jul 17, 2017
CVE-2017-10603
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15.1 prior to 15.1R3. Junos versions prior to 15.1 are not affected. No other Juniper Networks products or platforms are affected by this issue.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JO
Junos OS · Juniper
15.1x53; 15.1x53; 15.1x53; 15.1x53; 15.1x53; 15.1x53; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-10603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-10603
Third Party Advisory
http://www.securitytracker.com/id/1038901
Vendor Advisory
https://kb.juniper.net/JSA10805
More from Junos OS
9.8
CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
9.8
CVE-2020-1631
Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services
7.5
CVE-2015-5477
ISC BIND Data Processing Errors Vulnerability
5.3
CVE-2023-36851
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files
5.3
CVE-2023-36846
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files