CVE-2020-1615

CVE-2020-1615 affects Juniper Junos OS on vMX installations where the factory configuration ships with default root credentials. The issue is due to default credentials stored in the vMX configuration, enabling an unauthenticated user to access the vMX instance if the credentials are not changed....

CVE-2020-1616

Juniper Networks JATP and vJATP devices are affected by a vulnerability in the SSH login service due to insufficient server-side login attempt limit enforcement. An unauthenticated, remote attacker can perform multiple login attempts beyond the configured limit, enabling brute-force password atta...

CVE-2020-1613

The CVE describes a vulnerability in Juniper Junos OS BGP FlowSpec handling where receiving a specific FlowSpec advertisement can terminate an established BGP session. Affected products include Junos OS versions listed in the CVE (e.g., 12.3, 12.3X48, 14.1X53, 15.1R7-S5 and earlier, 16.1R7-S7 and...

CVE-2020-1614

CVE-2020-1614 : A hard-coded credentials vulnerability affects the Juniper Networks NFX250 Series vSRX VNF. It targets the vSRX VNF instance on versions prior to 19.2R1 and occurs when the root password has not been configured, allowing an attacker with access to an administrative service (e.g., ...

CVE-2020-1613 Junos OS: BGP session termination upon receipt of specific BGP FlowSpec advertisement.

A vulnerability in the BGP FlowSpec implementation may cause a Juniper Networks Junos OS device to terminate an established BGP session upon receiving a specific BGP FlowSpec advertisement. The BGP NOTIFICATION message that terminates an established BGP session is sent toward the peer device that...

CVE-2020-1614 NFX250 Series: Hardcoded credentials in the vSRX VNF instance.

A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function VNF instance, which allows an attacker to take control of the vSRX VNF instance if they have the ability to access an administrative service e.g. SSH on the VNF, either locally, or...

CVE-2020-1619: Improper Input Validation

A privilege escalation vulnerability in Juniper Networks QFX10K Series, EX9200 Series, MX Series, and PTX Series with Next-Generation Routing Engine NG-RE, allows a local authenticated high privileged user to access the underlying WRL host. This issue only affects QFX10K Series with NG-RE, EX9200...

CVE-2020-1618: Authentication Bypass Using an Alternate Path or Channel

On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any password. This issue might only occur in certain scenarios: • At the first reboot after performing device factory reset using the command...

CVE-2020-1617: Improper Initialization

This issue occurs on Juniper Networks Junos OS devices which do not support Advanced Forwarding Interface AFI / Advanced Forwarding Toolkit AFT. Devices using AFI and AFT are not exploitable to this issue. An improper initialization of memory in the packet forwarding architecture in Juniper...

CVE-2020-1616: Improper Restriction of Excessive Authentication Attempts

Due to insufficient server-side login attempt limit enforcement, a vulnerability in the SSH login service of Juniper Networks Juniper Advanced Threat Prevention JATP Series and Virtual JATP vJATP devices allows an unauthenticated, remote attacker to perform multiple login attempts in excess of th...

CVE-2020-1637: Authentication Bypass Using an Alternate Path or Channel

A vulnerability in Juniper Networks SRX Series device configured as a Junos OS Enforcer device may allow a user to access network resources that are not permitted by a UAC policy. This issue might occur when the IP address range configured in the Infranet Controller IC is configured as an IP...

CVE-2020-1615: Use of Hard-coded Credentials

The factory configuration for vMX installations, as shipped, includes default credentials for the root account. Without proper modification of these default credentials by the administrator, an attacker could exploit these credentials and access the vMX instance without authorization. This issue...

PT-2020-4138

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions 16.1 through 16.1R7-S5 Juniper Networks Junos OS versions 16.2 through 16.2R2-S10 Juniper Networks Junos OS versions 17.1 through 17.1R2-S10 Juniper Networks Junos OS versions 17.2 through 17.2R1-S8 Juniper...

PT-2020-4096

Name of the Vulnerable Software and Affected Versions: Juniper Networks NFX250 Network Services Platform vSRX VNF instance versions prior to 19.2R1 Description: A Use of Hard-coded Credentials issue exists in the NFX250 Series for the vSRX Virtual Network Function VNF instance. This allows an...

PT-2020-4142 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 12.3R12-S15 Juniper Networks Junos OS 12.3X48 versions prior to 12.3X48-D95 on SRX Series Juniper Networks Junos OS 14.1X50 versions prior to 14.1X50-D145 Juniper Networks Junos OS 14.1X53 versions...

PT-2020-4136

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 18.1R3 on vMX and MX150 Juniper Networks Junos OS versions prior to 18.2R3 on vMX and MX150 Juniper Networks Junos OS versions prior to 18.2X75-D60 on vMX and MX150 Juniper Networks Junos OS version...

CVE-2020-1628: Exposure of Sensitive Information to an Unauthorized Actor

Juniper Networks Junos OS uses the 128.0.0.0/2 subnet for internal communications between the RE and PFEs. It was discovered that packets utilizing these IP addresses may egress an EX4300 switch, leaking configuration information such as heartbeats, kernel versions, etc. out to the Internet,...

CVE-2020-1639: Improper Check or Handling of Exceptional Conditions

When an attacker sends a specific crafted Ethernet Operation, Administration, and Maintenance Ethernet OAM packet to a target device, it may improperly handle the incoming malformed data and fail to sanitize this incoming data resulting in an overflow condition. This overflow condition in Juniper...

CVE-2020-1629: Race Condition within a Thread

A race condition vulnerability on Juniper Network Junos OS devices may cause the routing protocol daemon RPD process to crash and restart while processing a BGP NOTIFICATION message. This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S6; 16.2 versions prior to 16.2R2-S11;...

The vulnerability of the Routing Engine module of the JunOS operating system, which allows a hacker to trigger a service failure.

The vulnerability of the Routing Engine module of the JunOS operating system is related to the failure to release resources after the expiration of their useful lifespan. Exploiting this vulnerability allows a malicious actor to cause service failures through specially created IPv6 traffic...