External Control of Critical State Data in Junos OS - CVE-2022-22154
Published: January 17, 2022
Vulnerability identifier: #VU59631
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-22154
CWE-ID: CWE-642
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insecure validation in the Junos Fusion setup of the satellite device. An attacker with physical access to device can make physical changes to the cabling of the device to cause a denial of service (DoS).
Affected software
Junos OS
How to mitigate CVE-2022-22154
Install updates from vendor's website.
Junos OS - addressed in versions 18.4R3-S10, 19.1R3-S7, 19.2R3-S4, 19.3R1