CVE-2020-1688 — Exposure of Private Personal Information to an Unauthorized Actor in Networks Junos OS
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 82.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedOct 16
Latest updateMay 24
Description
On Juniper Networks SRX Series and NFX Series, a local authenticated user with access to the shell may obtain the Web API service private key that is used to provide encrypted communication between the Juniper device and the authenticator services. Exploitation of this vulnerability may allow an attacker to decrypt the communications between the Juniper device and the authenticator service. This Web API service is used for authentication services such as the Juniper Identity Management Service, …
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 2.0 | Impact: 4.0
Affected Packages2 packages
🔴Vulnerability Details
2📋Vendor Advisories
1Juniper▶
CVE-2020-1688: On Juniper Networks SRX Series and NFX Series, a local authenticated user with access to the shell may obtain the Web API service private key that is↗2020-10-16