CVE-2020-1656 — Improper Input Validation in Networks Junos OS

CWE-20 — Improper Input ValidationCWE-476 — NULL Pointer Dereference4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.4%
top 36.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Junos OSJuniper Junos
Timeline
PublishedOct 16
Latest updateMay 24

Description

The DHCPv6 Relay-Agent service, part of the Juniper Enhanced jdhcpd daemon shipped with Juniper Networks Junos OS has an Improper Input Validation vulnerability which will result in a Denial of Service (DoS) condition when a DHCPv6 client sends a specific DHPCv6 message allowing an attacker to potentially perform a Remote Code Execution (RCE) attack on the target device. Continuous receipt of the specific DHCPv6 client message will result in an extended Denial of Service (DoS) condition. If adja…

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5juniper_networks/junos_os12.3 — 12.3R12-S15+20
▶NVDjuniper/junos21 versions+20

🔴Vulnerability Details

2
GHSA
GHSA-g45c-9f6f-ww87: The DHCPv6 Relay-Agent service, part of the Juniper Enhanced jdhcpd daemon shipped with Juniper Networks Junos OS has an Improper Input Validation vul↗2022-05-24
▶
CVEList
Junos OS: When a DHCPv6 Relay-Agent is configured upon receipt of a specific DHCPv6 client message, Remote Code Execution may occur.↗2020-10-16
▶

📋Vendor Advisories

1
Juniper
CVE-2020-1656: The DHCPv6 Relay-Agent service, part of the Juniper Enhanced jdhcpd daemon shipped with Juniper Networks Junos OS has an Improper Input Validation vul↗2020-10-16
▶
CVE-2020-1656 — Improper Input Validation | cvebase