PT-2018-1759 · Juniper Networks · Juniper Device Manager+1

Published 2018-10-10 · Updated 2019-10-09 · CVE-2018-0044

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions prior to 18.1R4 on NFX Series

Description The issue is related to an insecure SSHD configuration in Juniper Device Manager (JDM) and the host OS on Juniper NFX Series devices, which may allow remote unauthenticated access if any system passwords are empty. This is due to the PermitEmptyPasswords option being set to "yes". The vulnerability can be exploited by a remote attacker to gain full access to the device.

Recommendations For Juniper Networks Junos OS versions prior to 18.1R4 on NFX Series, update to version 18.1R4 or later to resolve the issue. As a temporary workaround, consider setting the PermitEmptyPasswords option to "no" to prevent remote unauthenticated access.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-258

Related Identifiers

BDU:2018-01359

CVE-2018-0044

Affected Products

Juniper Device Manager

Junos

References · 7

• https://osv.dev/vulnerability/CVE-2018-0044 · Vendor Advisory
• https://kb.juniper.net/JSA10878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0044 · Security Note
• https://bdu.fstec.ru/vul/2018-01359 · Security Note
• http://securityfocus.com/bid/105565 · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10878 · Note
• https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10878 · Note