CVE-2017-17023

CVE-2017-17023 affects Sophos UTM VPN endpoint using the NPC Engineering (NCP) Secure Entry Client 10.11 r32792 family (Sophos IPSec Client 11.04). The vulnerability lies in the VPN client’s software update feature: update metadata is fetched over HTTP (insecure) and the client does not verify th...