Junos OS Evolved: User is not logged out when the console cable is disconnected (Juniper Networks Junos OS Evolved)
En bref
- Source
- NVD
- EPSS
- EPSS 0.22 % · centile 12 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- juniper
- Statut NVD
- Analyzed
Rechercher sur…
Description
An Improper Physical Access Control vulnerability in the console port control of Juniper Networks Junos OS Evolved allows an attacker with physical access to the device to get access to a user account. When the console cable is disconnected, the logged in user is not logged out. This allows a malicious attacker with physical access to the console to resume a previous session and possibly gain administrative privileges. This issue affects Junos OS Evolved: * from 23.2R2-EVO before 23.2R2-S1-EVO, * from 23.4R1-EVO before 23.4R2-EVO.
Faiblesses (CWE)
- CWE-1263 — Improper Physical Access Control
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | juniper |
| CVSS 4.0 | HIGH 7.0 | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | juniper |
| CVSS 4.0 | HIGH 7.0 | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.1 | MEDIUM 6.6 | CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · sirt@juniper.net (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2024-38038
- GCVE · GCVE-0-2024-39512
Avis du CERT-FR
- CERTFR-2024-AVI-0781 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:juniper:junos_os_evolved:23.2:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:23.4:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:23.4:r1-s2:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Juniper Networks · Junos OS Evolved | affected 23.2R2-EVO < 23.2R2-S1-EVO ; affected 23.4R1-EVO < 23.4R2-EVO |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |