PT-2022-1470 · Juniper Networks · Junos

Published 2022-01-12 · Updated 2022-01-28 · CVE-2022-22154

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS versions 16.1R1 through 18.4R3-S10 Juniper Networks Junos OS versions 19.1 through 19.1R3-S7 Juniper Networks Junos OS versions 19.2 through 19.2R3-S4

Description The issue is related to an External Control of Critical State Data vulnerability in the Satellite Device control state machine of Juniper Networks Junos OS. This vulnerability can be exploited by an attacker who has physical access to the cabling between the Satellite Device and the original Aggregation Device, allowing them to cause a denial of service. The attacker can reboot the Satellite Device, which can then be controlled by an Aggregation Device that does not belong to the original Fusion setup.

Recommendations For Juniper Networks Junos OS versions 16.1R1 through 18.4R3-S10, update to version 18.4R3-S10 or later. For Juniper Networks Junos OS versions 19.1 through 19.1R3-S7, update to version 19.1R3-S7 or later. For Juniper Networks Junos OS versions 19.2 through 19.2R3-S4, update to version 19.2R3-S4 or later. As a temporary workaround, consider restricting physical access to the cabling between the Satellite Device and the Aggregation Device to minimize the risk of exploitation.

Fix

DoS

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-642

Related Identifiers

BDU:2022-00612

CVE-2022-22154

Affected Products

Junos

References · 6

• https://kb.juniper.net/JSA11262 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00612 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22154 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22154 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2022011704 · Note
• https://t.me/cibsecurity/35768 · Telegram Post