Metrics
No CVSS v4.0
No CVSS v3.1
Attack Vector Physical
Attack Complexity Low
Privileges Required High
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
Access Vector Local
Access Complexity Low
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
This CVE is not in the KEV list.
The EPSS score is 0.00151.
Key SSVC decision points have not yet been added.
Affected Vendors & Products
| Vendors | Products |
|---|---|
|
Juniper
Subscribe
|
Ex2200
Subscribe
Ex2300
Subscribe
Ex3300
Subscribe
Ex3400
Subscribe
Ex4200
Subscribe
Ex4300
Subscribe
Ex4500
Subscribe
Ex4550
Subscribe
Ex4600
Subscribe
Ex6200
Subscribe
Ex8200
Subscribe
Ex9200
Subscribe
Junos
Subscribe
Nfx
Subscribe
Qfx10000
Subscribe
Qfx3500
Subscribe
Qfx3600
Subscribe
Qfx5100
Subscribe
Qfx5110
Subscribe
Qfx5200
Subscribe
Srx100
Subscribe
Srx110
Subscribe
Srx1400
Subscribe
Srx1500
Subscribe
Srx210
Subscribe
Srx220
Subscribe
Srx240
Subscribe
Srx300
Subscribe
Srx320
Subscribe
Srx340
Subscribe
Srx3400
Subscribe
Srx345
Subscribe
Srx3600
Subscribe
Srx4100
Subscribe
Srx4200
Subscribe
Srx5400
Subscribe
Srx550
Subscribe
Srx5600
Subscribe
Srx5800
Subscribe
Srx650
Subscribe
|
Configuration 1 [-]
| AND |
|
Configuration 2 [-]
| AND |
|
Configuration 3 [-]
| AND |
|
Configuration 4 [-]
|
Configuration 5 [-]
| AND |
|
Configuration 6 [-]
|
Configuration 7 [-]
|
Configuration 8 [-]
| AND |
|
Configuration 9 [-]
| AND |
|
Configuration 10 [-]
| AND |
|
Configuration 11 [-]
|
No data.
No data.
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2018-0833 | An unauthenticated root login may allow upon reboot when a commit script is used. A commit script allows a device administrator to execute certain instructions during commit, which is configured under the [system scripts commit] stanza. Certain commit scripts that work without a problem during normal commit may cause unexpected behavior upon reboot which can leave the system in a state where root CLI login is allowed without a password due to the system reverting to a "safe mode" authentication state. Lastly, only logging in physically to the console port as root, with no password, will work. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D71 on SRX; 12.3X48 versions prior to 12.3X48-D55 on SRX; 14.1 versions prior to 14.1R9; 14.1X53 versions prior to 14.1X53-D40 on QFX, EX; 14.2 versions prior to 14.2R7-S9, 14.2R8; 15.1 versions prior to 15.1F5-S7, 15.1F6-S8, 15.1R5-S6, 15.1R6; 15.1X49 versions prior to 15.1X49-D110 on SRX; 15.1X53 versions prior to 15.1X53-D232 on QFX5200/5110; 15.1X53 versions prior to 15.1X53-D49, 15.1X53-D470 on NFX; 15.1X53 versions prior to 15.1X53-D65 on QFX10K; 16.1 versions prior to 16.1R2. No other Juniper Networks products or platforms are affected by this issue. |
Solution
The following software releases have been updated to resolve this specific issue: 12.1X46-D71, 12.3X48-D55, 14.1R9, 14.1X53-D40, 14.2R7-S9, 14.2R8, 15.1F5-S7, 15.1R5-S6, 15.1R6, 15.1X49-D110, 15.1X53-D232, 15.1X53-D65, 16.1R2, 16.2R1 and all subsequent releases.
Workaround
While there is no published workaround for this issue, customer can verify whether their commit script contains the affected configuration by rebooting the device. Please contact JTAC if after the reboot the device enters a state where root CLI login is allowed without a password.
No history.
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: juniper
Published:
Updated: 2024-09-16T20:57:31.677Z
Reserved: 2017-11-16T00:00:00
Link: CVE-2018-0008
No data.
Status : Modified
Published: 2018-01-10T22:29:01.213
Modified: 2024-11-21T03:37:20.790
Link: CVE-2018-0008
No data.
OpenCVE Enrichment
No data.
EUVD