Lucene search

JuniperCVE-2021-0266

HistoryApr 22, 2021 - 8:15 p.m.

CVE-2021-0266

2021-04-2220:15:09

CWE-798

CWE-321

juniper

web.nvd.nist.gov

cve-2021-0266

juniper networks

junos os

csrx series

cryptographic keys

security vulnerability

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

The use of multiple hard-coded cryptographic keys in cSRX Series software in Juniper Networks Junos OS allows an attacker to take control of any instance of a cSRX deployment through device management services. This issue affects: Juniper Networks Junos OS on cSRX Series: All versions prior to 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R2.

Affected configurations

Nvd

Node

juniperjunosMatch20.2r1

juniperjunosMatch20.2r1-s1

juniperjunosMatch20.2r1-s2

juniperjunosMatch20.2r1-s3

juniperjunosMatch20.3r1

juniperjunosMatch20.3r1-s1

juniperjunosMatch20.4r1

juniperjunosMatch20.4r1-s1

AND

junipercsrxMatch-

VendorProductVersionCPE
juniperjunos20.2cpe:2.3:o:juniper:junos:20.2:r1:*:*:*:*:*:*
juniperjunos20.2cpe:2.3:o:juniper:junos:20.2:r1-s1:*:*:*:*:*:*
juniperjunos20.2cpe:2.3:o:juniper:junos:20.2:r1-s2:*:*:*:*:*:*
juniperjunos20.2cpe:2.3:o:juniper:junos:20.2:r1-s3:*:*:*:*:*:*
juniperjunos20.3cpe:2.3:o:juniper:junos:20.3:r1:*:*:*:*:*:*
juniperjunos20.3cpe:2.3:o:juniper:junos:20.3:r1-s1:*:*:*:*:*:*
juniperjunos20.4cpe:2.3:o:juniper:junos:20.4:r1:*:*:*:*:*:*
juniperjunos20.4cpe:2.3:o:juniper:junos:20.4:r1-s1:*:*:*:*:*:*
junipercsrx-cpe:2.3:h:juniper:csrx:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
juniper	junos	20.2	cpe:2.3:o:juniper:junos:20.2:r1::::::
juniper	junos	20.2	cpe:2.3:o:juniper:junos:20.2:r1-s1::::::
juniper	junos	20.2	cpe:2.3:o:juniper:junos:20.2:r1-s2::::::
juniper	junos	20.2	cpe:2.3:o:juniper:junos:20.2:r1-s3::::::
juniper	junos	20.3	cpe:2.3:o:juniper:junos:20.3:r1::::::
juniper	junos	20.3	cpe:2.3:o:juniper:junos:20.3:r1-s1::::::
juniper	junos	20.4	cpe:2.3:o:juniper:junos:20.4:r1::::::
juniper	junos	20.4	cpe:2.3:o:juniper:junos:20.4:r1-s1::::::
juniper	csrx	-	cpe:2.3:h:juniper:csrx:-:::::::*

CNA Affected

[
  {
    "platforms": [
      "cSRX Series"
    ],
    "product": "Junos OS",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "20.2R3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "20.3R2",
        "status": "affected",
        "version": "20.3",
        "versionType": "custom"
      },
      {
        "lessThan": "20.4R2",
        "status": "affected",
        "version": "20.4",
        "versionType": "custom"
      }
    ]
  }
]

References

kb.juniper.net/JSA11157

Social References

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.002

Percentile

60.7%

JSON

Related for CVE-2021-0266