Zero-day vulnerability in Juniper ScreenOS

Authentication bypass
CVE-2015-7755

Revealed during source code review by the vendor.

Vulnerability details

Advisory: SB2015121701 - Two backdoors in Juniper ScreenOS

Vulnerable component: Juniper ScreenOS

CVE-ID: CVE-2015-7755

CVSSv3 score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CWE-ID: CWE-287 - Improper Authentication

Description:

The vulnerability allows a remote attacker to bypass authentication on the target system.

The weakness exists due to presence of backdoor in Juniper ScreenOS code. A remote attacker can enter a password "<<< %s(un='%s') = %u" during a SSH or TELNET session and obtain administrative access to the device.

Successful exploitation of the vulnerability results in unauthorized access to the vulnerable system.

Note: the vulnerability was being actively exploited.

Latest references in media:

Vulnerability Scanning SaaS

Vulnerability scanning SaaS service is online 3-rd generation vulnerability scanner with scheduled assessments and vulnerability subscription. You can use service to check security of your network perimeter.