title: Junos OS: NFX350: Password hashes stored in world-readable format
description: The Juniper Device Manager (JDM) container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes in the world-readable file /etc/passwd. This is not a security best current practice as it can allow an attacker with access to the local filesystem the ability to brute-force decrypt password hashes stored on the system. This issue affects Juniper Networks Junos OS on NFX350: 19.4 versions prior to 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2.
problem types: CWE-256 Unprotected Storage of Credentials
affected:
{
platforms: NFX350
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 19.4R3, status: affected, version: 19.4, versionType: custom
lessThan: 20.1R1-S4, 20.1R2, status: affected, version: 20.1, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: Junos OS now stores local password hashes in the protected /etc/shadow file.
The following software releases have been updated to resolve this specific issue: Junos OS 19.4R3, 20.1R1-S4, 20.1R2, 20.2R1, and all subsequent releases.
workarounds: Use access lists or firewall filters to limit access to the device only from trusted hosts.
Limit shell access to only trusted system administrators.