Junos OS: SRX Series: An attacker may be able to perform Man-in-the-Middle (MitM) attacks during app-id signature updates.

Vulnerability

The Application Identification (app-id) signature update client on Juniper Networks Junos OS for SRX Series devices fails to properly validate certificates during signature updates. This Improper Certificate Validation weakness affects Junos OS 15.1X49 versions prior to 15.1X49-D120 on SRX Series devices. No other versions are affected. The App-ID feature is documented in Juniper's official guide [1].

Exploitation

An attacker with a Man-in-the-Middle (MitM) network position can intercept the signature update traffic and present a fraudulent certificate. Because the client does not properly validate the certificate, the attacker can inject malicious signature updates. No authentication or user interaction is required beyond the network position.

Impact

Successful exploitation allows the attacker to compromise the integrity and confidentiality of the device. The attacker can potentially alter application identification behavior, leading to policy bypass or information disclosure. The exact privilege level gained is not specified, but the attack undermines the trust in the device's security functions.

Mitigation

The fix is included in Junos OS 15.1X49-D120 for SRX Series devices. Administrators should upgrade to this version or later. No workarounds are documented in the available references. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog as of the publication date.