Incorrect default permissions in Juniper Networks, Inc. products - CVE-2021-0246
Published: April 19, 2021
Vulnerability identifier: #VU52324
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-0246
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local administrator can inadvertently send their network traffic to one or more tenants while concurrently modifying the overall device system traffic management, affecting all tenants and the service provider.
Affected software
SRX5000
SRX4600
SRX4200
SRX4100
SRX1500
Junos OS
SRX4600
SRX4200
SRX4100
SRX1500
Junos OS
How to mitigate CVE-2021-0246
Install updates from vendor's website.
Junos OS - addressed in versions 18.3R3, 18.4R2, 19.1R2, 19.2R1