PT-2018-1759 · Juniper Networks · Juniper Device Manager+1

Publicado

2018-10-10

·

Atualizado

2019-10-09

·

CVE-2018-0044

CVSS v2.0

10

Crítica

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 18.1R4 on NFX Series
Description The issue is related to an insecure SSHD configuration in Juniper Device Manager (JDM) and the host OS on Juniper NFX Series devices, which may allow remote unauthenticated access if any system passwords are empty. This is due to the PermitEmptyPasswords option being set to "yes". The vulnerability can be exploited by a remote attacker to gain full access to the device.
Recommendations For Juniper Networks Junos OS versions prior to 18.1R4 on NFX Series, update to version 18.1R4 or later to resolve the issue. As a temporary workaround, consider setting the PermitEmptyPasswords option to "no" to prevent remote unauthenticated access.

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287CWE-258

Identificadores relacionados

BDU:2018-01359
CVE-2018-0044

Produtos afetados

Juniper Device Manager
Junos