Junos OS Evolved: ACX Series with Paragon Active Assurance Test Agent: A local high privileged attacker can recover other administrators credentials (Juniper Networks Junos OS Evolved)

CVE-2024-30406

MEDIUM 6.7

At a glance

Source: NVD
EPSS: EPSS 0.14 % · percentile 3 (2026-10-31)
State: PUBLISHED
Published: 2024-04-12 15:04 UTC
Updated: 2024-08-02 01:32 UTC
Assigner: juniper
NVD status: Analyzed

Search on…

Description

A Cleartext Storage in a File on Disk vulnerability in Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on network devices allows a local, authenticated attacker with high privileges to read all other users login credentials. This issue affects only Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on these devices from 23.1R1-EVO through 23.2R2-EVO. This issue does not affect releases before 23.1R1-EVO.

Weaknesses (CWE)

CWE-313 — Cleartext Storage in a File or on Disk

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N	juniper
CVSS 4.0	MEDIUM 6.7	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N	juniper
CVSS 4.0	MEDIUM 6.7	CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · sirt@juniper.net (Secondary)
CVSS 3.1	MEDIUM 5.5	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N	NVD · sirt@juniper.net (Secondary)

European references

ENISA EUVD · EUVD-2024-28327
GCVE · GCVE-0-2024-30406

CERT-FR advisories

CERTFR-2024-AVI-0297 — Multiples vulnérabilités dans Juniper · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:juniper:paragon_active_assurance_test_agent:-:*:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.1:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.1:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.1:r2:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.1:r3:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:*
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:*

Affected products

Product	Versions
Juniper Networks · Junos OS Evolved	affected 23.1R1-EVO ≤ 23.2R2-EVO

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 Junos OS Evolved: ACX Series with Paragon Active Assurance Test Agent: A local high privileged attacker can recover other administrators credentials (Juniper Networks Junos OS Evolved)