CVE-2017-2345 — Improper Input Validation in Networks Junos OS

CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
3.2%
top 12.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Juniper Networks Junos OSJuniper JunosJuniper Junos OS
Timeline
PublishedJul 17
Latest updateMay 13

Description

On Junos OS devices with SNMP enabled, a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to crash and restart by sending a crafted SNMP packet. Repeated crashes of the snmpd daemon can result in a partial denial of service condition. Additionally, it may be possible to craft a malicious SNMP packet in a way that can result in remote code execution. SNMP is disabled in Junos OS by default. Junos OS devices with SNMP disabled are not affected by this iss…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5juniper_networks/junos_os16 versions+15
▶NVDjuniper/junos15 versions+14

🔴Vulnerability Details

1
GHSA
GHSA-x5fx-jf24-m9ww: On Junos OS devices with SNMP enabled, a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to crash and rest↗2022-05-13
▶

📋Vendor Advisories

1
Juniper
CVE-2017-2345: On Junos OS devices with SNMP enabled, a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to crash and rest↗2017-07-17
▶
CVE-2017-2345 — Improper Input Validation | cvebase