Products
Juniper Networks Session Smart Router
- 5.6.15
- 6.1.9-lts
- 6.2.5-sts
Juniper Networks Session Smart Conductor
- 5.6.15
- 6.1.9-lts
- 6.2.5-sts
Juniper Networks WAN Assurance Router
- 6.1.9-lts
- 6.2.5-sts
Source
sirt@juniper.net
Tags
CVE-2024-2973 details
Last Modified : June 27, 2024, 9:15 p.m.
Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running in high-availability redundant configurations are affected by this vulnerability. No other Juniper Networks products or platforms are affected by this issue. This issue affects: Session Smart Router: * All versions before 5.6.15, * from 6.0 before 6.1.9-lts, * from 6.2 before 6.2.5-sts. Session Smart Conductor: * All versions before 5.6.15, * from 6.0 before 6.1.9-lts, * from 6.2 before 6.2.5-sts. WAN Assurance Router: * 6.0 versions before 6.1.9-lts, * 6.2 versions before 6.2.5-sts.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10.0 |
|---|
Weakness
| Weakness | Name | Description |
|---|---|---|
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | A product requires authentication, but the product has an alternate path or channel that does not require authentication. |
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
10.0
Exploitability Score
3.9
Impact Score
6.0
Base Severity
CRITICAL
Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://support.juniper.net/support/eol/software/ssr/ | sirt@juniper.net |
| https://supportportal.juniper.net/JSA83126 | sirt@juniper.net |