CVSS: 6.8EPSS: 0%CPEs: 279EXPL: 0CVE-2022-22154 – Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS
https://notcve.org/view.php?id=CVE-2022-22154
In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Juniper Networks Junos OS allows an attacker who is able to make physical changes to the cabling of the device to cause a denial of service (DoS). An SD can get rebooted and subsequently controlled by an Aggregation Device (AD) which does not belong to the original Fusion setup and is just connected to an extended port of the SD. To carry out this attack the attacker needs to have physical access to the cabling between the SD and the original AD. This issue affects: Juniper Networks Junos OS 16.1R1 and later versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S4. This issue does not affect Juniper Networks Junos OS versions prior to 16.1R1. • https://kb.juniper.net/JSA11262 • CWE-642: External Control of Critical State Data CWE-668: Exposure of Resource to Wrong Sphere •
CVSS: 7.5EPSS: 0%CPEs: 104EXPL: 0CVE-2022-22153 – SRX Series and MX Series with SPC3: A high percentage of fragments might lead to high latency or packet drops
https://notcve.org/view.php?id=CVE-2022-22153
An Insufficient Algorithmic Complexity combined with an Allocation of Resources Without Limits or Throttling vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on SRX Series and MX Series with SPC3 allows an unauthenticated network attacker to cause latency in transit packet processing and even packet loss. If transit traffic includes a significant percentage (> 5%) of fragmented packets which need to be reassembled, high latency or packet drops might be observed. This issue affects Juniper Networks Junos OS on SRX Series, MX Series with SPC3: All versions prior to 18.2R3; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2-S9, 18.4R3; 19.1 versions prior to 19.1R2; 19.2 versions prior to 19.2R1-S1, 19.2R2. Una Complejidad Algorítmica no Suficiente Combinada con una vulnerabilidad de Asignación de Recursos sin Límites o Estrangulamiento en el demonio de procesamiento de flujos (flowd) de Junos OS de Juniper Networks en las series SRX y MX con SPC3 permite a un atacante de red no autenticado causar latencia en el procesamiento de paquetes en tránsito e incluso la pérdida de paquetes. Si el tráfico de tránsito incluye un porcentaje significativo (más del 5%) de paquetes fragmentados que deben volver a ensamblarse, puede observarse una alta latencia o pérdidas de paquetes. • https://kb.juniper.net/JSA11261 • CWE-407: Inefficient Algorithmic Complexity CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.9EPSS: 0%CPEs: 227EXPL: 0CVE-2021-31386 – Junos OS: When using J-Web with HTTP an attacker may retrieve encryption keys via Person-in-the-Middle attacks.
https://notcve.org/view.php?id=CVE-2021-31386
A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle (PitM) attacks against the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S20; 15.1 versions prior to 15.1R7-S11; 18.3 versions prior to 18.3R3-S6; 18.4 versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S4; 19.3 versions prior to 19.3R3-S4; 19.4 versions prior to 19.4R3-S6; 20.1 versions prior to 20.1R3-S2; 20.2 versions prior to 20.2R3-S3; 20.3 versions prior to 20.3R3-S1; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R2. Una vulnerabilidad de fallo del mecanismo de protección en el servicio J-Web HTTP de Juniper Networks Junos OS permite a un atacante remoto no autenticado llevar a cabo ataques de tipo Person-in-the-Middle (PitM) contra el dispositivo. Este problema afecta a: Juniper Networks Junos OS 12.3 versiones anteriores a 12.3R12-S20; 15.1 versiones anteriores a 15.1R7-S11; versiones 18.3 anteriores a 18.3R3-S6; versiones 18.4 anteriores a 18.4R3-S10; versiones 19.1 anteriores a 19.1R3-S7; versiones 19.2 anteriores a 19.2R3-S4; 19. 3 versiones anteriores a 19.3R3-S4; versiones 19.4 anteriores a 19.4R3-S6; versiones 20.1 anteriores a 20.1R3-S2; versiones 20.2 anteriores a 20.2R3-S3; versiones 20.3 anteriores a 20.3R3-S1; versiones 20.4 anteriores a 20.4R3; versiones 21.1 anteriores a 21.1R3; 21.2 versiones anteriores a 21.2R2 • https://kb.juniper.net/JSA11254 • CWE-300: Channel Accessible by Non-Endpoint CWE-311: Missing Encryption of Sensitive Data CWE-325: Missing Cryptographic Step CWE-693: Protection Mechanism Failure •
CVSS: 8.8EPSS: 0%CPEs: 211EXPL: 0CVE-2021-31385 – Junos OS: J-Web: A path traversal vulnerability allows an authenticated attacker to elevate their privileges to root
https://notcve.org/view.php?id=CVE-2021-31385
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in J-Web of Juniper Networks Junos OS allows any low-privileged authenticated attacker to elevate their privileges to root. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S19; 15.1 versions prior to 15.1R7-S10; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R3-S9; 19.1 versions prior to 19.1R3-S6; 19.2 versions prior to 19.2R1-S7, 19.2R3-S3; 19.3 versions prior to 19.3R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R2-S2, 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. Una vulnerabilidad de Limitación Inapropiada de un Nombre de Ruta a un Directorio Restringido ("Salto de Ruta") en J-Web de Juniper Networks Junos OS permite a cualquier atacante autenticado poco privilegiado elevarlos a root. Este problema afecta a: Juniper Networks Junos OS 12.3 versiones anteriores a 12.3R12-S19; 15.1 versiones anteriores a 15.1R7-S10; versiones 18.3 anteriores a 18.3R3-S5; versiones 18.4 anteriores a 18.4R3-S9; versiones 19.1 anteriores a 19.1R3-S6; versiones 19.2 anteriores a 19.2R1-S7, 19.2R3-S3; 19. 3 versiones anteriores a 19.3R3-S3; versiones 19.4 anteriores a 19.4R3-S5; versiones 20.1 anteriores a 20.1R2-S2, 20.1R3-S1; versiones 20.2 anteriores a 20.2R3-S2; versiones 20.3 anteriores a 20.3R3; versiones 20.4 anteriores a 20.4R2-S1, 20.4R3; versiones 21.1 anteriores a 21.1R1-S1, 21.1R2 • https://kb.juniper.net/JSA11253 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 69EXPL: 0CVE-2021-31383 – Junos OS and Junos OS Evolved: In Point to MultiPoint (P2MP) scenarios receipt of various crafted packets causes RPD to core.
https://notcve.org/view.php?id=CVE-2021-31383
In Point to MultiPoint (P2MP) scenarios within established sessions between network or adjacent neighbors the improper use of a source to destination copy write operation combined with a Stack-based Buffer Overflow on certain specific packets processed by the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved sent by a remote unauthenticated network attacker causes the RPD to crash causing a Denial of Service (DoS). Continued receipt and processing of these packets will create a sustained Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS 19.2 versions prior to 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 19.2R1. Juniper Networks Junos OS Evolved 20.1 versions prior to 20.1R3-EVO; 20.2 versions prior to 20.2R3-EVO; 20.3 versions prior to 20.3R2-EVO. • https://kb.juniper.net/JSA11251 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •