CVE-2020-1608

CVE-2020-1608 affects Juniper Networks Junos OS on MX Series in BBE configurations. Receipt of a specific MPLS or IPv6 packet on the core-facing interface may trigger a kernel crash (vmcore) and reboot, tied to processing for BBE clients. Affected Junos versions span multiple tracks: 17.2R2-S6 on...

CVE-2020-1607 Junos OS: Cross-Site Scripting (XSS) in J-Web

Insufficient Cross-Site Scripting XSS protection in J-Web may potentially allow a remote attacker to inject web script or HTML, hijack the target user's J-Web session and perform administrative actions on the Junos device as the targeted user. This issue affects Juniper Networks Junos OS 12.3...

CVE-2020-1609

CVE-2020-1609 describes a vulnerability in Juniper JDHCPD (IPv6 in relay mode) that allows an attacker to arbitrarily execute commands as root on target devices. Affected software includes Junos OS and Junos OS Evolved versions listed in the CVE description (various 15.1, 16.x, 17.x, 18.x, and 19...

CVE-2020-1605 Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv4 packets and arbitrarily execute commands on the target device.

When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon JDHCPD process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may then arbitrarily execute commands as root on the target device. This...

CVE-2020-1606

CVE-2020-1606 is a path-traversal flaw in Junos OS/J-Web that allows an authenticated J-Web user to read files world-readable and delete world-writable ones. Affected Junos OS releases include 12.3 (before 12.3R12-S13), 12.3X48 (before 12.3X48-D85) on SRX, 14.1X53 (before 14.1X53-D51), 15.1F6 (be...

CVE-2020-1605

CVE-2020-1605 affects Juniper Networks JDHCPD (relay mode) in Junos OS/Junos OS Evolved. A crafted IPv4 packet can cause arbitrary root command execution on the target via the JDHCPD process handling. Affected are IPv4 JDHCPD services; vulnerable versions include multiple releases listed (e.g., J...

CVE-2020-1606 Junos OS: Path traversal vulnerability in J-Web

A path traversal vulnerability in the Juniper Networks Junos OS device may allow an authenticated J-web user to read files with 'world' readable permission and delete files with 'world' writeable permission. This issue does not affect system files that can be accessed only by root user. This issu...

CVE-2020-1603

CVE-2020-1603 is a Junos OS IPv6 handling vulnerability causing a mbuf memory leak in the Routing Engine that can lead to kernel crash (vmcore) or device hang/DoS. Affected: Junos OS 16.1 versions before 16.1R7-S6; 16.1R7-S6 and later in 16.1X70-D10+; 16.2 before 16.2R2-S11; 17.1 before 17.1R2-S1...

CVE-2020-1604

CVE-2020-1604 affects Junos OS on EX4300/EX4600/QFX3500/QFX5100 series. The IP firewall filter component may fail to evaluate certain IPv4/IPv6 packets destined to the Routing Engine, but L2/L3 filter paths to hosts are unaffected. Affected releases include 14.1X53 before certain D revisions (QFX...

CVE-2020-1604 Junos OS: EX4300/EX4600/QFX3500/QFX5100 Series: Stateless IP firewall filter may fail to evaluate certain packets

On EX4300, EX4600, QFX3500, and QFX5100 Series, a vulnerability in the IP firewall filter component may cause the firewall filter evaluation of certain packets to fail. This issue only affects firewall filter evaluation of certain packets destined to the device Routing Engine RE. This issue does...

CVE-2020-1601

Summary of CVE-2020-1601 (Junos OS pccd DoS) Affects Juniper Networks Junos OS running as Path Computation Client (PCC) in a PCEP environment. The issue is caused by insufficient input validation in Junos’ Path Computation Element Protocol daemon (pccd), allowing an attacker to send certain malfo...

CVE-2020-1602 Junos OS and Junos OS Evolved: A vulnerability in JDHCPD allows an attacker to send crafted IPv4 packets may take over the code execution of the JDHCPD process.

When a device using Juniper Network's Dynamic Host Configuration Protocol Daemon JDHCPD process on Junos OS or Junos OS Evolved which is configured in relay mode it vulnerable to an attacker sending crafted IPv4 packets who may remotely take over the code execution of the JDHDCP process. This iss...

CVE-2020-1601 Junos OS: Upon receipt of certain types of malformed PCEP packets the pccd process may crash.

Certain types of malformed Path Computation Element Protocol PCEP packets when received and processed by a Juniper Networks Junos OS device serving as a Path Computation Client PCC in a PCEP environment using Juniper's path computational element protocol daemon pccd process allows an attacker to...

CVE-2020-1602

CVE-2020-1602 affects Juniper Networks Junos OS and Junos OS Evolved where JDHCPD (IPv4 relay mode) can be remotely exploited by crafted IPv4 packets to take over the JDHCPD process. Affected products include Junos OS releases listed as prior to the specified versions (e.g., 15.1, 15.1R7-S6; 16.1...

CVE-2020-1600

CVE-2020-1600 in Juniper Junos OS RPD: A specific SNMP command in a P2MP LSP scenario can trigger an infinite loop, causing high CPU and DoS across SNMPv4/v6. Affected Junos versions include 12.3X48 prior to 12.3X48-D90; 15.1 prior to 15.1R7-S6; 15.1X49 prior to 15.1X49-D200; 15.1X53 prior to 15....

CVE-2020-1600 Junos OS: A specific SNMP command can trigger a high CPU usage Denial of Service in the RPD daemon.

In a Point-to-Multipoint P2MP Label Switched Path LSP scenario, an uncontrolled resource consumption vulnerability in the Routing Protocol Daemon RPD in Juniper Networks Junos OS allows a specific SNMP request to trigger an infinite loop causing a high CPU usage Denial of Service DoS condition...

Junos Space: Malicious HTTP packets sent to Junos Space allow an attacker to view all files on the device.

A Local File Inclusion vulnerability in Juniper Networks Junos Space allows an attacker to view all files on the target when the device receives malicious HTTP packets. This issue affects: Juniper Networks Junos Space versions prior to 19.4R1. Recent assessments: busterb at January 30, 2020 8:09a...

Juniper Networks Junos OS JDHCPD Command Injection Vulnerability

Juniper Networks Junos OS is a set of network operating systems dedicated to the company's hardware devices. A security vulnerability in Juniper Networks Junos OS Dynamic Host Configuration Protocol Daemon JDHCPD can be exploited by a remote attacker to submit a special IPv6 request that can be...

Juniper Networks Junos OS IP firewall filter access control error vulnerability

Juniper Networks Junos OS is a set of network operating systems dedicated to the company's hardware devices. A security vulnerability exists in the Juniper Networks Junos OS IP firewall filter, which can be exploited by remote attackers to submit a special request that can bypass security...

Juniper Networks Junos OS JDHCPD IPv4 Command Injection Vulnerability

Juniper Networks Junos OS is a set of network operating systems dedicated to the company's hardware devices. A security vulnerability in Juniper Networks Junos OS Dynamic Host Configuration Protocol Daemon JDHCPD can be exploited by a remote attacker to submit a special IPv4 request that can be...