PT-2021-12974 · Juniper Networks · Junos

Published 2021-04-22 · Updated 2022-09-20 · CVE-2021-0266

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS on cSRX Series versions prior to 20.2R3 Juniper Networks Junos OS on cSRX Series version 20.3 prior to 20.3R2 Juniper Networks Junos OS on cSRX Series version 20.4 prior to 20.4R2

Description: The issue in Juniper Networks Junos OS on cSRX Series allows an attacker to take control of any instance of a cSRX deployment through device management services due to the use of multiple hard-coded cryptographic keys.

Recommendations: For versions prior to 20.2R3, update to version 20.2R3 or later. For version 20.3 prior to 20.3R2, update to version 20.3R2 or later. For version 20.4 prior to 20.4R2, update to version 20.4R2 or later.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

CVE-2021-0266

Affected Products

Junos

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2021-0266 · Security Note
• https://osv.dev/vulnerability/CVE-2021-0266 · Vendor Advisory
• https://kb.juniper.net/JSA11157 · Vendor Advisory