Security readout for executives and security teams
Some Juniper SRX300 series firewalls could appear to have MACsec link encryption enabled while actually falling back to an unencrypted link. The business risk is misplaced trust: sensitive traffic may traverse a local link without the expected confidentiality or integrity protection. Exposure is limited to organizations using affected Junos OS on SRX300 series and relying on MACsec. SRX300 and SRX320 had no MACsec-capable ports, while SRX340 and SRX345 support was limited to control and fabric ports. Treat this as high priority where SRX300 series devices protect sensitive internal links with MACsec. It is not described as remote code execution, but it can undermine encryption assurance and expose confidential traffic on adjacent network segments. Mitigation focus: Review Juniper JSA10790 for official fixed-release guidance.; Upgrade affected SRX300 series systems to 15.1X49-D100 or a vendor-supported fixed release.; Verify MACsec is configured only on MACsec-capable SRX340/SRX345 control or fabric ports..
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-392: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2017-2342 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N2.85.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.1HighVector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.juniper.net/JSA10790CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Report of Error Condition
Missing Report of Error Condition represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.