CWE Code: 295
Vulnerability Type: privilege_escalation
CVSS Score: 5.8
CWE Name:  Improper Certificate Validation
Summary: in f5 big-ip pem 12.1.0 through 12.1.2 when downloading the type allocation code (tac) database file via https, the server's certificate is not verified. attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. tac databases are used in big-ip pem for device type and os (dtos) and tethering detection. customers not using big-ip pem, not configuring downloads of tac database files, or not using http for that download are not affected.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/NONE
Published Date: 2017-10-20
Last Modified Date: 2017-11-15