CVE-2017-2304

moderate-risk

Published 2017-05-30

Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, 15.1 prior to 15.1R2, do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets. This issue is also known as 'Etherleak'

Do I need to act?

0.96% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (19)

Junos

Affected Vendors

Juniper

References (6)

Third Party Advisory http://www.securityfocus.com/bid/95403

Third Party Advisory http://www.securitytracker.com/id/1037593

Vendor Advisory https://kb.juniper.net/JSA10773

Third Party Advisory http://www.securityfocus.com/bid/95403

Third Party Advisory http://www.securitytracker.com/id/1037593

Vendor Advisory https://kb.juniper.net/JSA10773

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 3/34 · Minimal

Exposure 19/34 · Moderate