title: Junos OS: Junos Fusion: Hard-coded credentials on satellite devices allows a locally authenticated attacker to elevate their privileges.
description: A Use of Hard-coded Credentials vulnerability in Juniper Networks Junos OS on Junos Fusion satellite devices allows an attacker who is local to the device to elevate their privileges and take control of the device. This issue affects: Juniper Networks Junos OS Junos Fusion Satellite Devices. 16.1 versions prior to 16.1R7-S7; 17.1 versions prior to 17.1R2-S12, 17.1R3-S2; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S10; 17.4 version 17.4R3 and later versions; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3; 18.3 versions prior to 18.3R1-S7, 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S6, 18.4R2-S4, 18.4R3-S1; 19.1 versions prior to 19.1R1-S5, 19.1R2-S1, 19.1R3; 19.2 versions prior to 19.2R1-S4, 19.2R2; 19.3 versions prior to 19.3R2-S5, 19.3R3; 19.4 versions prior to 19.4R1-S1, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2. This issue does not affected Junos OS releases prior to 16.1R1 or all 19.2R3 and 19.4R3 release versions.
problem types: CWE-798 Use of Hard-coded Credentials
affected:
{
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 16.1R7-S7, status: affected, version: 16.1, versionType: custom
lessThan: 17.1R2-S12, 17.1R3-S2, status: affected, version: 17.1, versionType: custom
lessThan: 17.2R3-S4, status: affected, version: 17.2, versionType: custom
lessThan: 17.3R3-S8, status: affected, version: 17.3, versionType: custom
changes: [at: 17.4R3, status: affected], lessThan: 17.4R2-S10, status: affected, version: 17.4, versionType: custom
lessThan: 18.1R3-S10, status: affected, version: 18.1, versionType: custom
lessThan: 18.2R2-S7, 18.2R3-S3, status: affected, version: 18.2, versionType: custom
lessThan: 18.3R1-S7, 18.3R2-S4, 18.3R3-S2, status: affected, version: 18.3, versionType: custom
lessThan: 18.4R1-S6, 18.4R2-S4, 18.4R3-S1, status: affected, version: 18.4, versionType: custom
lessThan: 19.1R1-S5, 19.1R2-S1, 19.1R3, status: affected, version: 19.1, versionType: custom
lessThan: 19.2R1-S4, 19.2R2, status: affected, version: 19.2, versionType: custom
lessThan: 19.3R2-S5, 19.3R3, status: affected, version: 19.3, versionType: custom
lessThan: 19.4R1-S1, 19.4R2, status: affected, version: 19.4, versionType: custom
lessThan: 20.1R1-S1, 20.1R2, status: affected, version: 20.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: Junos OS: 16.1R7-S7, 17.1R2-S12, 17.1R3-S2, 17.2R3-S4, 17.3R3-S8, 17.4R2-S10, 18.1R3-S10, 18.2R2-S7, 18.2R3-S3, 18.3R1-S7, 18.3R2-S4, 18.3R3-S2, 18.4R1-S6, 18.4R2-S4, 18.4R3-S1, 19.1R1-S5, 19.1R2-S1, 19.1R3, 19.2R1-S4, 19.2R2, 19.3R2-S5, 19.3R3, 19.4R1-S1, 19.4R2, 20.1R1-S1, 20.1R2, 20.2R1, and all subsequent releases.
workarounds: There are no viable workarounds for this issue.
To reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to only trusted administrative networks, hosts and users.