PT-2020-14879 · Juniper Networks · Junos Evolved

Published 2020-10-16 · Updated 2021-10-25 · CVE-2020-1666

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved versions 18.4R1-EVO through 20.2R1-EVO

Description The system console configuration option 'log-out-on-disconnect' fails to log out an active CLI session when the console cable is disconnected, potentially allowing a malicious attacker with physical access to the console to resume a previous interactive session and possibly gain administrative privileges.

Recommendations For Juniper Networks Junos OS Evolved versions 18.4R1-EVO through 20.2R1-EVO, update to version 20.2R1-EVO or later to resolve the issue.

Fix

Improper Access Control

Insufficient Session Expiration

Weakness Enumeration

CWE-284

CWE-613

Related Identifiers

CVE-2020-1666

Affected Products

Junos Evolved

References · 3

• https://osv.dev/vulnerability/CVE-2020-1666 · Vendor Advisory
• https://kb.juniper.net/JSA11063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1666 · Security Note