PT-2022-1444 · Juniper Networks · Junos Evolved
Published
2022-01-12
·
Updated
2022-01-26
·
CVE-2022-22164
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Juniper Networks Junos OS Evolved versions prior to 20.4R2-S2-EVO
Juniper Networks Junos OS Evolved version 21.1R1-EVO
Juniper Networks Junos OS Evolved versions prior to 21.2R2-EVO
Description
An Improper Initialization issue may cause a commit operation for disabling the telnet service to not take effect as expected, resulting in the telnet service staying enabled. Administrators can verify whether telnet is operating in the background by issuing the command
show system connections | grep :23. This may show a connection like tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN 20879/xinetd, indicating the telnet service is still active.Recommendations
For Juniper Networks Junos OS Evolved versions prior to 20.4R2-S2-EVO, update to version 20.4R2-S2-EVO or later.
For Juniper Networks Junos OS Evolved version 21.1R1-EVO, update to a version later than 21.1R1-EVO.
For Juniper Networks Junos OS Evolved versions prior to 21.2R2-EVO, update to version 21.2R2-EVO or later.
As a temporary workaround, consider disabling the telnet service manually until a patch is available. Restrict access to the telnet service to minimize the risk of exploitation.
Fix
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Junos Evolved