by Kastro
Paper/Archive/CVE-2015-7755

CVE-2015-7755

Juniper ScreenOS — Juniper ScreenOS Improper Authentication Vulnerability

KEV · due 23 OctEPSS 61%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.2.992 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refarstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-trafficrefwired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoorsrefsecuritytracker.com/id/1034489writeupkb.cert.org/vuls/id/640184refforums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554refgithub.com/hdm/juniper-cve-2015-7755refkb.juniper.net/InfoCenter/index?page=content&id=JSA10713reftwitter.com/cryptoron/statuses/677900647560253442refadamcaudill.com/2015/12/17/much-ado-about-juniperrefforbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unauthorized-code-to-network-gearrefsecurityfocus.com/bid/79626refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7755kevcisa.gov/known-exploited-vulnerabilities-catalog