CVE-2017-17023

CVE-2017-17023 describes a critical vulnerability in the Sophos IPSec Client (version 11.04) and its rebranded NCP Secure Entry Client (version 10.11 r32792). This vulnerability allows a man-in-the-middle or man-on-the-side attacker to execute arbitrary malicious software on a user's computer during a software update. The issue stems from the client requesting update metadata over insecure HTTP and failing to validate the digital signature of the update. Rated with a CVSS score of 8.1 (HIGH), this vulnerability has a network attack vector and high impact on confidentiality, integrity, and availability, despite requiring high attack complexity. The EPSS score is very low, indicating a minimal probability of exploitation. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are also minimal, suggesting a lack of widespread attention.