Junos OS: After removing ssh public key authentication root can still log in (Juniper Networks Junos OS)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.68 % · percentile 53 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- juniper
- NVD status
- Analyzed
Description
A UI Discrepancy for Security Feature vulnerability in the UI of Juniper Networks Junos OS on VM Host systems allows a network-based, unauthenticated attacker to access the device. On VM Host Routing Engines (RE), even if the configured public key for root has been removed, remote users which are in possession of the corresponding private key can still log in as root. This issue affects Junos OS: * all versions before 22.2R3-S7, * 22.4 versions before 22.4R3-S5, * 23.2 versions before 23.2R2-S3, * 23.4 versions before 23.4R2-S3, * 24.2 versions before 24.2R1-S2, 24.2R2.
Weaknesses (CWE)
- CWE-446 — UI Discrepancy for Security Feature
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | juniper |
| CVSS 4.0 | HIGH 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/R:U/RE:M | juniper |
| CVSS 4.0 | HIGH 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:M/U:X | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · sirt@juniper.net (Secondary) |
European references
- ENISA EUVD · EUVD-2025-21147
- GCVE · GCVE-0-2025-52983
CERT-FR advisories
- CERTFR-2025-AVI-0583 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*< 22.2cpe:2.3:o:juniper:junos:22.2:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r3-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r3-s5:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.2:r3-s6:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos:22.4:r3-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.2:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.2:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.2:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.2:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.2:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.2:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.2:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.4:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.4:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.4:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.4:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.4:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos:23.4:r2-s1:*:*:*:*:*:*- +5 more
Affected products
| Product | Versions |
|---|---|
| Juniper Networks · Junos OS | affected 0 < 22.2R3-S7 ; affected 22.4 < 22.4R3-S5 ; affected 23.2 < 23.2R2-S3 ; affected 23.4 < 23.4R2-S3 ; affected 24.2 < 24.2R1-S2, 24.2R2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |