US-based networking products maker Juniper Networks has issued out-of-band security updates to address a critical vulnerability in some of its routers, which could lead to an authentication bypass.
The flaw, identified as CVE-2024-2973, exists due to missing authentication checks when running with a redundant peer. A remote non-authenticated attacker can bypass authentication and take full control over the affected device.
According to Juniper, the vulnerability affects only routers or conductors running in high-availability redundant configurations. The issue affects the following products:
Session Smart Router:
-
All versions before 5.6.15,
-
from 6.0 before 6.1.9-lts,
-
from 6.2 before 6.2.5-sts.
Session Smart Conductor:
-
All versions before 5.6.15,
-
from 6.0 before 6.1.9-lts,
-
from 6.2 before 6.2.5-sts.
WAN Assurance Router:
-
6.0 versions before 6.1.9-lts,
-
6.2 versions before 6.2.5-sts.
Juniper Networks has released the security updates in the following versions to mitigate the vulnerability: Session Smart Router versions 5.6.15, 6.1.9-lts, and 6.2.5-sts.
“This vulnerability has been patched automatically on affected devices for MIST managed WAN Assurance routers connected to the Mist Cloud,” Juniper said in a security advisory. “It is important to note that the fix is applied automatically on managed routers by a Conductor or on WAN assurance routers has no impact on data-plane functions of the router. The application of the fix is non-disruptive to production traffic. There may be a momentary downtime (less than 30 seconds) to the web-based management and APIs however this will resolve quickly.”
Although the vendor said it has no evidence this flaw is being exploited in the wild, users are advised to update their systems as soon as possible.
