CVE-2017-10603

Status: ModifiedHigh (7.8)—
An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15.1 prior to 15.1R3. Junos versions prior to 15.1 are not affected. No other Juniper Networks products or platforms are affected by this issue.
CVSS

Version: 3.0
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base score: 7.8
Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.44%
Percentile among all scored CVEs: 36
Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)

Juniper — Junos
CWEs

CWE-91
References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-10603",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "sirt@juniper.net",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "sirt@juniper.net",
      "affectedData": [
        {
          "vendor": "Juniper Networks",
          "product": "Junos OS",
          "versions": [
            {
              "status": "affected",
              "version": "15.1X53 prior to 15.1X53-D47"
            },
            {
              "status": "affected",
              "version": "15.1 prior to 15.1R3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-17T13:18:18.687",
  "references": [
    {
      "url": "http://www.securitytracker.com/id/1038901",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "sirt@juniper.net"
    },
    {
      "url": "https://kb.juniper.net/JSA10805",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "sirt@juniper.net"
    },
    {
      "url": "http://www.securitytracker.com/id/1038901",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kb.juniper.net/JSA10805",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-91"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An XML injection vulnerability in Junos OS CLI can allow a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS 15.1X53 prior to 15.1X53-D47, 15.1 prior to 15.1R3. Junos versions prior to 15.1 are not affected. No other Juniper Networks products or platforms are affected by this issue."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección XML en la CLI de Junos OS puede permitir que un usuario autenticado localmente eleve privilegios y ejecute comandos arbitrarios como el usuario root. Este problema se detectó durante las pruebas internas de seguridad del producto. Las versiones afectadas son Juniper Networks Junos OS versión 15.1X53 anterior a 15.1X53-D47, versión 15.1 anterior a 15.1R3. Las versiones de Junos anteriores a 15.1 no se ven afectadas. Ningún otro producto o plataforma de Juniper Networks se ve afectado por este problema."
    }
  ],
  "lastModified": "2026-06-17T01:00:25.607",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B71FB14A-67D4-4EDD-BB32-07764F5AFA6E"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E87C765-8D68-404A-AC71-3F22A7260E8C"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E3B807C-196D-42B8-9042-7582A1366772"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d21:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83FEEE8F-9279-46F2-BAF9-A60537020C61"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d25:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1DD0B95A-7C9F-4A18-9CD8-BA344DEFC9D4"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d30:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F294E43-73FA-4EF3-90F2-EE29C56D6573"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d32:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EDDE1048-BFEA-4A3E-8270-27C538A68837"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d33:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC517CD0-FF35-498F-AD33-683B43CA3829"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d34:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53F7E1C5-BFA9-426C-9F95-3EA5DB458C7E"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d40:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2B5ED13-F998-447C-8FEA-047FE9FE2F4B"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1x53:d45:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "65F3CD2A-D5E1-4EFF-9013-6D81B396F765"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD0952C4-FFCC-4A78-ADFC-289BD6E269DB"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:a1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83AB8877-3DC0-4B8C-B864-1BF18C368337"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C56F5C48-BA48-4EE1-88BE-782B3CFB3B90"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C56E6C3-BBB6-4853-91D9-99C7676D0CD4"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f2-s1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AC196685-3B0C-4754-AE6A-6BE456CC6B52"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f2-s2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F0146AA9-C513-4871-A62A-52C9F40EB958"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f2-s3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A18672EF-E33D-4ACE-BB0A-561812F502C7"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f2-s4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEF0E75F-831E-40B8-926D-B2E92A84E31B"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E0ECBD8-3D66-49DA-A557-5695159F0C06"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0EAA2998-A0D6-4818-9E7C-25E8099403E7"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71D211B9-B2FE-4324-AAEE-8825D5238E48"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:f7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD332D86-5DA7-49A4-98C3-E4D946832DC1"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0D3EA8F-4D30-4383-AF2F-0FB6D822D0F3"
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:15.1:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E6CD065-EC06-4846-BD2A-D3CA7866070F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "sirt@juniper.net"
}