Vulnerability · Published Oct 16, 2020 · Assigned by juniper

CVE-2020-1666Junos OS Evolved: 'console log-out-on-disconnect' fails to terminate session on console cable disconnection

Medium 6.6

In plain English

A medium-severity improper access control in Junos OS Evolved from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.3%top 74.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactive session and possibly gain administrative privileges. This issue affects all Juniper Networks Junos OS Evolved versions after 18.4R1-EVO, prior to 20.2R1-EVO.

Affected products (as reported)

Vendor	Product	Versions
Juniper Networks	Junos OS Evolved	unspecified – before 20.2R1-EVO

Weakness: CWE-284 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://kb.juniper.net/JSA11063 x_refsource_CONFIRM