PT-2024-2949 · Juniper Networks · Junos

Published 2024-04-10 · Updated 2026-01-23 · CVE-2024-30406

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS Evolved ACX Series devices versions 23.1R1-EVO through 23.2R2-EVO

Description A Cleartext Storage in a File on Disk issue allows a local, authenticated attacker with high privileges to read all other users' login credentials. This issue is related to the Paragon Active Assurance Test Agent software installed on the devices. The vulnerability is associated with the unencrypted storage of credentials, which could allow an attacker to gain unauthorized access to protected information.

Recommendations For versions 23.1R1-EVO through 23.2R2-EVO, update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-313

Related Identifiers

BDU:2024-03116

CVE-2024-30406

Affected Products

Junos

References · 8

• https://bdu.fstec.ru/vul/2024-03116 · Security Note
• https://supportportal.juniper.net/JSA79104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30406 · Security Note
• https://first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-30406 · Vendor Advisory
• https://juniper.net/documentation/us/en/software/junos/junos-install-upgrade-evo/topics/topic-map/paa-test-agent-install.html · Note
• https://juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/services-paa-test-agent.html · Note
• https://t.me/cveNotify/149715 · Telegram Post