Security restrictions bypass in Juniper Junos OS - CVE-2017-2343
Published: July 13, 2017
Vulnerability identifier: #VU7508
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2017-2343
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Juniper Networks, Inc.
Affected software:
Juniper Junos OS
Juniper Junos OS
Detailed vulnerability description
The vulnerability allows a remote attacker to gain root access to the target system.
The weakness exists due to use of hard-coded authentication credentials by the Integrated User Firewall feature. A remote attacker can pass these credentials in clear text or in an encrypted format and gain control of the target system, other SRX Series devices in the same environment and Active Directory servers and services.
Successful exploitation of the vulnerability results in full control over the system.
The weakness exists due to use of hard-coded authentication credentials by the Integrated User Firewall feature. A remote attacker can pass these credentials in clear text or in an encrypted format and gain control of the target system, other SRX Series devices in the same environment and Active Directory servers and services.
Successful exploitation of the vulnerability results in full control over the system.
How to mitigate CVE-2017-2343
Update to version 12.3X48-D35, 15.1X49-D50.