Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.6.15, 6.1.9-lts, 6.2.5-sts
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: total
Summary
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running in high-availability redundant configurations are affected by this vulnerability. No other Juniper Networks products or platforms are affected by this issue. This issue affects: Session Smart Router: • All versions before 5.6.15, • from 6.0 before 6.1.9-lts, • from 6.2 before 6.2.5-sts. Session Smart Conductor: • All versions before 5.6.15, • from 6.0 before 6.1.9-lts, • from 6.2 before 6.2.5-sts. WAN Assurance Router: • 6.0 versions before 6.1.9-lts, • 6.2 versions before 6.2.5-sts.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: total
- Record last updated
Affected versions
- Juniper Networks Session Smart Router
fixed in 5.6.15; From 6.0 · fixed in 6.1.9-lts; From 6.2 · fixed in 6.2.5-sts
- Juniper Networks Session Smart Conductor
fixed in 5.6.15; From 6.0 · fixed in 6.1.9-lts; From 6.2 · fixed in 6.2.5-sts
- Juniper Networks WAN Assurance Router
From 6.0 · fixed in 6.1.9-lts; From 6.2 · fixed in 6.2.5-sts