Lucene search

K
cvelistJuniperCVELIST:CVE-2020-1669
HistoryOct 14, 2020 - 12:00 a.m.

CVE-2020-1669 Junos OS: NFX350: Password hashes stored in world-readable format

2020-10-1400:00:00
CWE-256
juniper
www.cve.org
6

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

0

Percentile

12.6%

The Juniper Device Manager (JDM) container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes in the world-readable file /etc/passwd. This is not a security best current practice as it can allow an attacker with access to the local filesystem the ability to brute-force decrypt password hashes stored on the system. This issue affects Juniper Networks Junos OS on NFX350: 19.4 versions prior to 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2.

CNA Affected

[
  {
    "platforms": [
      "NFX350"
    ],
    "product": "Junos OS",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "19.4R3",
        "status": "affected",
        "version": "19.4",
        "versionType": "custom"
      },
      {
        "lessThan": "20.1R1-S4, 20.1R2",
        "status": "affected",
        "version": "20.1",
        "versionType": "custom"
      }
    ]
  }
]

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

6.3

Confidence

High

EPSS

0

Percentile

12.6%

Related for CVELIST:CVE-2020-1669