// For flags

CVE-2024-30406

Junos OS Evolved: ACX Series with Paragon Active Assurance Test Agent: A local high privileged attacker can recover other administrators credentials

Severity Score

6.7
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A Cleartext Storage in a File on Disk vulnerability in Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on network devices allows a local, authenticated attacker with high privileges to read all other users login credentials.

This issue affects only Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on these devices from 23.1R1-EVO through 23.2R2-EVO. 

This issue does not affect releases before 23.1R1-EVO.

Una vulnerabilidad de almacenamiento de texto plano en un archivo en disco en dispositivos Juniper Networks Junos OS Evolved ACX Series que utilizan el software Paragon Active Assurance Test Agent instalado en dispositivos de red permite a un atacante local autenticado con altos privilegios leer las credenciales de inicio de sesión de todos los demás usuarios. Este problema afecta solo a los dispositivos Juniper Networks Junos OS Evolved ACX Series que utilizan el software Paragon Active Assurance Test Agent instalado en estos dispositivos desde 23.1R1-EVO hasta 23.2R2-EVO. Este problema no afecta a las versiones anteriores a 23.1R1-EVO.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Attack Requirements
None
Privileges Required
High
User Interaction
Passive
System
Vulnerable | Subsequent
Confidentiality
High
High
Integrity
None
None
Availability
None
None
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-03-26 CVE Reserved
  • 2024-04-12 CVE Published
  • 2024-04-13 EPSS Updated
  • 2024-08-02 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-313: Cleartext Storage in a File or on Disk
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Juniper Networks
Search vendor "Juniper Networks"
 Junos OS Evolved
Search vendor "Juniper Networks" for product "Junos OS Evolved"
 >= 23.1R1-EVO <= 23.2R2-EVO
Search vendor "Juniper Networks" for product "Junos OS Evolved" and version " >= 23.1R1-EVO <= 23.2R2-EVO"
en
Affected