CVE-2020-1666 — Improper Access Control in Networks Junos OS Evolved

CWE-284 — Improper Access ControlCWE-613 — Insufficient Session Expiration4 documents4 sources
Severity
6.6MEDIUMNVD
EPSS
0.0%
top 87.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Junos OS EvolvedJuniper Junos OS Evolved
Timeline
PublishedOct 16
Latest updateMay 24

Description

The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactive session and possibly gain administrative privileges. This issue affects all Juniper Networks Junos OS Evolved versions after 18.4R1-EVO, prior to 20.2R1-EVO.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 0.7 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5juniper_networks/junos_os_evolvedunspecified — 20.2R1-EVO
▶NVDjuniper/junos_os_evolved4 versions+3

🔴Vulnerability Details

2
GHSA
GHSA-62gf-43c6-cfmp: The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the c↗2022-05-24
▶
CVEList
Junos OS Evolved: 'console log-out-on-disconnect' fails to terminate session on console cable disconnection↗2020-10-16
▶

📋Vendor Advisories

1
Juniper
CVE-2020-1666: The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the c↗2020-10-16
▶
CVE-2020-1666 — Improper Access Control | cvebase