Cleartext storage of sensitive information in Junos OS Evolved - CVE-2024-30406
Published: April 10, 2024
Vulnerability identifier: #VU88442
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-30406
CWE-ID: CWE-312
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the Paragon Active Assurance Test Agent software installed on the ACX Series devices stored users credential in clear text. A local privileged user can read the file and obtain credentials of other users.
Affected software
Junos OS Evolved
How to mitigate CVE-2024-30406
Install updates from vendor's website.
Junos OS Evolved - addressed in versions 23.2R2-EVO, 23.3R1-EVO