Vulnerability · Published Apr 8, 2020 · Assigned by juniper
CVE-2020-1615Junos OS: vMX: Default credentials supplied in vMX configuration
Critical 9.8
In plain English
A critical-severity hard-coded credentials in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 78% of all known vulnerabilities).
Official description
The factory configuration for vMX installations, as shipped, includes default credentials for the root account. Without proper modification of these default credentials by the administrator, an attacker could exploit these credentials and access the vMX instance without authorization. This issue affects Juniper Networks Junos OS: 17.1 versions prior to 17.1R2-S11, 17.1R3-S2 on vMX; 17.2 versions prior to 17.2R3-S3 on vMX; 17.3 versions prior to 17.3R2-S5, 17.3R3-S7 on vMX; 17.4 versions prior to 17.4R2-S9, 17.4R3 on vMX; 18.1 versions prior to 18.1R3-S9 on vMX; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3 on vMX; 18.2X75 versions prior to 18.2X75-D420, 18.2X75-D60 on vMX; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3-S1 on vMX; 18.4 versions prior to 18.4R1-S5, 18.4R2-S3, 18.4R3 on vMX; 19.1 versions prior to 19.1R1-S4, 19.1R2, 19.1R3 on vMX; 19.2 versions prior to 19.2R1-S3, 19.2R2 on vMX; 19.3 versions prior to 19.3R1-S1, 19.3R2 on vMX.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 17.1 – before 17.1R2-S11, 17.1R3-S217.2 – before 17.2R3-S317.3 – before 17.3R2-S5, 17.3R3-S717.4 – before 17.4R2-S9, 17.4R318.1 – before 18.1R3-S918.2 – before 18.2R2-S7, 18.2R3-S318.2X75 – before 18.2X75-D420, 18.2X75-D6018.3 – before 18.3R1-S7, 18.3R2-S3, 18.3R3-S1 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://kb.juniper.net/JSA10998 x_refsource_CONFIRM