Log in Start free

Actively exploited · Published Dec 19, 2015 · Assigned by mitre

CVE-2015-7755

Critical 9.8 Exploited

In plain English

A critical-severity improper authentication in ScreenOS from Juniper. Attackers are actively exploiting it in the wild (listed by CISA on October 2, 2025). The chance it is exploited in the next 30 days is estimated at 61.1% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)61.1%top 0.8% of all CVEs
Exploited in the wildYesCISA KEV since Oct 2, 2025
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Oct 23, 2025.

Official description

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References