SB2023041707 - Insecure root password recovery in Junos OS NFX Series
Published: April 17, 2023
Security Bulletin ID
SB2023041707
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Physical access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-28972)
The vulnerability allows an attacker to compromise the affected system.
The vulnerability exists due to improperly imposed security restrictions on the console port. When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on NFX Series systems, leading to a possible administrative bypass with physical access to the console.
Remediation
Install update from vendor's website.