// For flags

CVE-2019-0035

Junos OS: 'set system ports console insecure' allows root password recovery on OAM volumes

Severity Score

6.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on systems booted from an OAM (Operations, Administration, and Maintenance) volume, leading to a possible administrative bypass with physical access to the console. OAM volumes (e.g. flash drives) are typically instantiated as /dev/gpt/oam, or /oam for short. Password recovery, changing the root password from a console, should not have been allowed from an insecure console. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496, 15.1X53-D68; 16.1 versions prior to 16.1R3-S10, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2. This issue does not affect Junos OS releases prior to 15.1.

Cuando se habilita "set system ports console insecure", el inicio de sesión de root no está permitido para el Junos OS como se esperaba. Sin embargo, la contraseña de root puede ser cambiada usando "set system root-authentication plain-text-password" en sistemas iniciados desde un volumen OAM (Operations, Administration, and Maintenance), lo que lleva a un posible bypass administrativo con acceso físico a la consola. Los volúmenes de OAM (por ejemplo, unidades flash) se suelen instanciar como /dev/gpt/oam, u /oam para abreviar. La recuperación de la contraseña, cambiando la contraseña de root desde una consola, no debería haber sido permitida desde una consola insegura. Las versiones afectadas son Juniper Networks Junos OS: 15.1 versiones anteriores a 15.1F6-S12, 15.1R7-S3; 15.1X49 versiones anteriores a 15.1X49-D160; 15.1X53 versiones anteriores a 15.1X53-D236, 15.1X53-D496, 15.1X53-D68; 16.1 versiones anteriores a 16.1R3-S10, 16.1R6-S6, 16.1R7-S3; 16.1X65 versiones anteriores a 16.1X65-D49; 16.2 versiones anteriores a 16.2R2-S8; 17.1 versiones anteriores a 17.1R2-S10, 17.1R3; 17.2 versiones anteriores a 17.2R1-S8, 17.2R3-S1; 17.3 versiones anteriores a 17.3R3-S3; 17.4 versiones anteriores a 17.4R1-S6, 17.4R2-S2; 18.1 versiones anteriores a 18.1R2-S4, 18.1R3-S3; 18.2 versiones anteriores a 18.2R2; 18.2X75 versiones anteriores a 18.2X75-D40; 18.3 versiones anteriores a 18.3R1-S2. Este problema no afecta a las versiones del Junos OS anteriores a la 15.1.

*Credits: N/A
CVSS Scores
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-10-11 CVE Reserved
  • 2019-04-10 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-501: Trust Boundary Violation
  • CWE-522: Insufficiently Protected Credentials
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
URL Date SRC
https://kb.juniper.net/JSA10924 2021-02-05
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
f2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
f3
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
f4
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
f5
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
f6
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
f7
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
r2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
r3
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
r4
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
r5
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1
Search vendor "Juniper" for product "Junos" and version "15.1"
r6
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d10
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d100
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d110
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d120
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d130
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d150
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d20
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d30
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d35
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d40
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d45
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d50
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d60
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d65
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d70
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d75
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d80
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x49
Search vendor "Juniper" for product "Junos" and version "15.1x49"
d90
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d10
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d20
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d21
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d210
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d230
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d231
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d232
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d233
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d25
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d30
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d32
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d33
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d34
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d40
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d45
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d495
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d56
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d60
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d61
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d62
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
15.1x53
Search vendor "Juniper" for product "Junos" and version "15.1x53"
d63
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1
Search vendor "Juniper" for product "Junos" and version "16.1"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1
Search vendor "Juniper" for product "Junos" and version "16.1"
r2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1
Search vendor "Juniper" for product "Junos" and version "16.1"
r3
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1
Search vendor "Juniper" for product "Junos" and version "16.1"
r4
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1
Search vendor "Juniper" for product "Junos" and version "16.1"
r5
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1
Search vendor "Juniper" for product "Junos" and version "16.1"
r6
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1
Search vendor "Juniper" for product "Junos" and version "16.1"
r7
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.3
Search vendor "Juniper" for product "Junos" and version "17.3"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.3
Search vendor "Juniper" for product "Junos" and version "17.3"
r2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.3
Search vendor "Juniper" for product "Junos" and version "17.3"
r3
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.2
Search vendor "Juniper" for product "Junos" and version "17.2"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.2
Search vendor "Juniper" for product "Junos" and version "17.2"
r1-s7
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.2
Search vendor "Juniper" for product "Junos" and version "17.2"
r2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.2
Search vendor "Juniper" for product "Junos" and version "17.2"
r3
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.4
Search vendor "Juniper" for product "Junos" and version "17.4"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.4
Search vendor "Juniper" for product "Junos" and version "17.4"
r1-s7
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.4
Search vendor "Juniper" for product "Junos" and version "17.4"
r2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
18.1
Search vendor "Juniper" for product "Junos" and version "18.1"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
18.1
Search vendor "Juniper" for product "Junos" and version "18.1"
r2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
18.1
Search vendor "Juniper" for product "Junos" and version "18.1"
r3-s2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
18.2
Search vendor "Juniper" for product "Junos" and version "18.2"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
18.2
Search vendor "Juniper" for product "Junos" and version "18.2"
r1-s3
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
18.3
Search vendor "Juniper" for product "Junos" and version "18.3"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
18.3
Search vendor "Juniper" for product "Junos" and version "18.3"
r1-s1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
18.2x75
Search vendor "Juniper" for product "Junos" and version "18.2x75"
-
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1x65
Search vendor "Juniper" for product "Junos" and version "16.1x65"
d30
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1x65
Search vendor "Juniper" for product "Junos" and version "16.1x65"
d35
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.1x65
Search vendor "Juniper" for product "Junos" and version "16.1x65"
d40
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.1
Search vendor "Juniper" for product "Junos" and version "17.1"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
17.1
Search vendor "Juniper" for product "Junos" and version "17.1"
r2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.2
Search vendor "Juniper" for product "Junos" and version "16.2"
r1
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.2
Search vendor "Juniper" for product "Junos" and version "16.2"
r2
Affected
Juniper
Search vendor "Juniper"
Junos
Search vendor "Juniper" for product "Junos"
16.2
Search vendor "Juniper" for product "Junos" and version "16.2"
r2-s7
Affected