Cybersecurity specialists reported the detection of multiple critical vulnerabilities in JunOS, the operating system used in many of Juniper Networks’ network solutions. According to the report, successful exploitation of these flaws would allow the deployment of multiple malicious scenarios.
Below are brief descriptions of the reported vulnerabilities, in addition to their respective tracking keys and scores according to the Common Vulnerability Scoring System (CVSS).
CVE-2021-0208: The flaw exists due to insufficient validation of user-provided input in the Routing Protocol Daemon (RPD) service. According to experts, the remote threat actors can send specially designed RSVP packages and deploy a denial-of-service attack or execute arbitrary code on the system.
This vulnerability received a score of 7.7/10 and its successful exploitation could compromise the affected systems completely. The flaw lies in the following versions of Juniper Network JunOS products:
- All versions earlier than 17.3R3-S10 except 15.1X49-D240 for SRX series
- 17.4 versions prior to 17.4R3-S2
- 18.1 versions earlier than 18.1R3-S10
- 18.2 versions earlier than 18.2R2-S7, 18.2R3-S4
- 18.3 versions earlier than 18.3R3-S2
- 18.4 versions earlier than 18.4R1-S8, 18.4R2-S6, 18.4R3-S2
- 19.1 versions earlier than 19.1R1-S5, 19.1R3-S3
- 19.2 versions earlier than 19.2R3
- 19.3 versions earlier than 19.3R2-S5, 19.3R3
- 19.4 versions earlier than 19.4R2-S2, 19.4R3-S1
- 20.1 versions earlier than 20.1R1-S4, 20.1R2
- Versions of 15.1X49 earlier than 15.1X49-D240 in the SRX series
CVE-2020-2805: Incorrect input validation within the Libraries component in Java SE Embedded would allow unauthenticated remote attackers to exploit the flaw to execute arbitrary code.
The vulnerability received a score of 5.5/10 and would allow threat actors to fully compromise vulnerable systems. Affected versions of Juniper JunOS Space are
- v20.3R1 and earlier versions
CVE-2020-8616: Inadequate management of internal resources with the application would allow threat actors to cause a recurring server to issue a large number of recoveries in an attempt to process the reference.
The flaw received a score of 7.5/10 on the CVSS scale and resides in the following versions of JunOS Space:
- v20.3R1 and earlier
CVE-2019-11745: A limit error when processing untrusted entries within the NSC_EncryptUpdate() function in /lib/softoken/pkcs11c.c would allow threat actors to execute arbitrary code on compromised systems.
This is a critical vulnerability that received a score of 8.5/10 and its exploitation could lead to compromise of the affected system. The vulnerability lies in the following versions of JunOS Space:
- 20,3R1 and earlier
Although these flaws can be exploitable remotely by unauthenticated threat actors, experts mention that no active exploit incidents have yet been detected. Updates are now available, so users in affected deployments are encouraged to fix as soon as possible.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.