CVE-2020-1617

CVE-2020-1617 affects Junos OS on non-AFI/AFT platforms. An improper memory initialization in the packet forwarding architecture can be triggered when a genuine packet is inspected by sFlow through a specific firewall policer, causing a reboot and, after reboot, a core file and another reboot on ...

CVE-2020-1618 Junos OS: EX and QFX Series: Console port authentication bypass vulnerability

On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any password. This issue might only occur in certain scenarios: • At the first reboot after performing device factory reset using the command...

CVE-2020-1615

CVE-2020-1615 affects Juniper Junos OS on vMX installations where the factory configuration ships with default root credentials. The issue is due to default credentials stored in the vMX configuration, enabling an unauthenticated user to access the vMX instance if the credentials are not changed....

CVE-2020-1613 Junos OS: BGP session termination upon receipt of specific BGP FlowSpec advertisement.

A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session upon receiving a specific BGP FlowSpec advertisement. The BGP NOTIFICATION message that terminates an established BGP session is sent toward the peer device that...

CVE-2020-1613

The CVE describes a vulnerability in Juniper Junos OS BGP FlowSpec handling where receiving a specific FlowSpec advertisement can terminate an established BGP session. Affected products include Junos OS versions listed in the CVE (e.g., 12.3, 12.3X48, 14.1X53, 15.1R7-S5 and earlier, 16.1R7-S7 and...

PT-2020-4094

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions 12.3 through 18.2X75-D20 Description: A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session upon receiving a specific BGP...

CVE-2020-1617: Improper Initialization

This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface AFI / Advanced Forwarding Toolkit AFT. Devices using AFI and AFT are not exploitable to this issue. An improper initialization of memory in the packet forwarding architecture in Juniper...

CVE-2020-1619: Improper Input Validation

A privilege escalation vulnerability in Juniper Networks QFX10K Series, EX9200 Series, MX Series, and PTX Series with Next-Generation Routing Engine NG-RE, allows a local authenticated high privileged user to access the underlying WRL host. This issue only affects QFX10K Series with NG-RE, EX9200...

CVE-2020-1618: Authentication Bypass Using an Alternate Path or Channel

On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any password. This issue might only occur in certain scenarios: • At the first reboot after performing device factory reset using the command...

PT-2020-4142 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 12.3R12-S15 Juniper Networks Junos OS 12.3X48 versions prior to 12.3X48-D95 on SRX Series Juniper Networks Junos OS 14.1X50 versions prior to 14.1X50-D145 Juniper Networks Junos OS 14.1X53 versions...

CVE-2020-1638: Use of sizeof() on a Pointer Type

The FPC Flexible PIC Concentrator of Juniper Networks Junos OS and Junos OS Evolved may restart after processing a specific IPv4 packet. Only packets destined to the device itself, successfully reaching the RE through existing edge and control plane filtering, will be able to cause the FPC restar...

CVE-2020-1637: Authentication Bypass Using an Alternate Path or Channel

A vulnerability in Juniper Networks SRX Series device configured as a Junos OS Enforcer device may allow a user to access network resources that are not permitted by a UAC policy. This issue might occur when the IP address range configured in the Infranet Controller IC is configured as an IP...

CVE-2020-1630: Time-of-check Time-of-use (TOCTOU) Race Condition

A privilege escalation vulnerability in Juniper Networks Junos OS devices configured with dual Routing Engines RE, Virtual Chassis VC or high-availability cluster may allow a local authenticated low-privileged user with access to the shell to perform unauthorized configuration modification. This...

CVE-2020-1627: Undefined Security Weakness

A vulnerability in Juniper Networks Junos OS on vMX and MX150 devices may allow an attacker to cause a Denial of Service DoS by sending specific packets requiring special processing in microcode that the flow cache can't handle, causing the riot forwarding daemon to crash. By continuously sending...

PT-2020-4135

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions prior to 19.1R1-EVO Description: A vulnerability in Juniper Networks Junos OS Evolved may allow an attacker to cause a Denial of Service DoS by sending a high rate of specific packets to the device, resulting in a...

CVE-2020-1620: Improper Control of a Resource Through its Lifetime

A local, authenticated user with shell can obtain the hashed values of login passwords via configd streamer log. This issue affects all versions of Junos OS Evolved prior to 19.3R1...

CVE-2020-1639: Improper Check or Handling of Exceptional Conditions

When an attacker sends a specific crafted Ethernet Operation, Administration, and Maintenance Ethernet OAM packet to a target device, it may improperly handle the incoming malformed data and fail to sanitize this incoming data resulting in an overflow condition. This overflow condition in Juniper...

PT-2020-4098

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 12.3R12-S14 Juniper Networks Junos OS 12.3X48 versions prior to 12.3X48-D86, 12.3X48-D90 Juniper Networks Junos OS 14.1X53 versions prior to 14.1X53-D51 Juniper Networks Junos OS 15.1 versions prior...

PT-2020-4133

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions prior to 19.2R1 Description: The issue is related to insufficient protection of registration data in the ev.ops configuration file. This allows a local, authenticated user with shell access to view sensitive...

PT-2020-4091

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on EX and QFX Series versions 14.1X53 through 14.1X53-D52 Juniper Networks Junos OS on EX and QFX Series versions 15.1 through 15.1R7-S3 Juniper Networks Junos OS on EX and QFX Series versions 15.1X53 through...