CVE-2018-0021 — Networks Junos OS vulnerability

4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.2%
top 63.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Juniper Networks Junos OSJuniper JunosJuniper Junos OS
Timeline
PublishedApr 11
Latest updateMay 13

Description

If all 64 digits of the connectivity association name (CKN) key or all 32 digits of the connectivity association key (CAK) key are not configured, all remaining digits will be auto-configured to 0. Hence, Juniper devices configured with short MacSec keys are at risk to an increased likelihood that an attacker will discover the secret passphrases configured for these keys through dictionary-based and brute-force-based attacks using spoofed packets. Affected releases are Juniper Networks Junos OS:…

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5juniper_networks/junos_os14.1 — 14.1R10, 14.1R9+7
▶NVDjuniper/junos8 versions+7

🔴Vulnerability Details

1
GHSA
GHSA-cm2c-mr99-4v22: If all 64 digits of the connectivity association name (CKN) key or all 32 digits of the connectivity association key (CAK) key are not configured, all↗2022-05-13
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Edge Chakra JIT - Parameter Scope Parsing Type Confusion↗2018-08-17
▶

📋Vendor Advisories

1
Juniper
CVE-2018-0021: If all 64 digits of the connectivity association name (CKN) key or all 32 digits of the connectivity association key (CAK) key are not configured, all↗2018-04-11
▶
CVE-2018-0021 — Juniper Networks Junos OS vulnerability | cvebase