CVE-2024-47495Authorization Bypass Through User-Controlled Key in Networks Junos OS Evolved

Severity
8.4HIGHNVD
EPSS
0.0%
top 97.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 11

Description

An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines (REs) are in use on Juniper Networks Junos OS Evolved devices. This issue affects: Juniper Networks Junos OS Evolved with dual-REs: * All versions before 21.2R3-S8-EVO, * from 21.4-EVO before 21.4R3-S8-EVO, * from 22.2-EVO before 22.2R3-S4-EVO, * from 22.3-EVO before 22.3R3-S4-EVO, * from 22.4-EVO before 22.4R3-S

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

CVEListV5juniper_networks/junos_os_evolved21.4-EVO21.4R3-S8-EVO+6

🔴Vulnerability Details

2
CVEList
Junos OS Evolved: In a dual-RE scenario a locally authenticated attacker with shell privileges can take over the device.2024-10-11
GHSA
GHSA-rcvr-9vmp-37hx: An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of th2024-10-11

📋Vendor Advisories

1
Juniper
CVE-2024-47495: An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of th2024-10-11
CVE-2024-47495 — HIGH severity | cvebase