CVE-2017-6144

CVE-2017-6144 describes a critical vulnerability in F5 BIG-IP Policy Enforcement Manager (PEM) versions 12.1.0 through 12.1.2. The flaw stems from the product's failure to verify server certificates when downloading Type Allocation Code (TAC) database files via HTTPS. This oversight allows attackers in a privileged network position to conduct man-in-the-middle (MitM) attacks, potentially compromising the integrity and confidentiality of these critical TAC databases used for Device Type and OS (DTOS) and Tethering detection. The vulnerability carries a CVSSv3 score of 7.4 (High), indicating a significant risk. Its attack vector is network-based with high impact on confidentiality and integrity, though it requires high attack complexity due to the need for a privileged network position. However, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting it has not garnered widespread attention.