CVE-2020-1614: NFX250 Series: Hardcoded credentials in the vSRX VNF instance.
First published: Wed Apr 08 2020(Updated: )
A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to take control of the vSRX VNF instance if they have the ability to access an administrative service (e.g. SSH) on the VNF, either locally, or through the network. This issue only affects the NFX250 Series vSRX VNF. No other products or platforms are affected. This issue is only applicable to environments where the vSRX VNF root password has not been configured. This issue affects the Juniper Networks NFX250 Network Services Platform vSRX VNF instance on versions prior to 19.2R1.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Juniper JUNOS | <19.2 | |
| Juniper JUNOS | =19.2-r1-s1 | |
| Juniper JUNOS | =19.2-r1-s2 | |
| Juniper JUNOS | =19.2-r1-s3 | |
| Juniper JUNOS | =19.2-r1-s4 | |
| Juniper Nfx250 |
Remedy
The following software releases have been updated to resolve this specific issue: NFX250 Series version 19.2R1, and all subsequent releases. By upgrading, the hard-coded password is removed from the configuration.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-1614?
CVE-2020-1614 is a Use of Hard-coded Credentials vulnerability that exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance.
How severe is CVE-2020-1614?
CVE-2020-1614 has a severity level of critical.
How can an attacker take control of the vSRX VNF instance through CVE-2020-1614?
An attacker can take control of the vSRX VNF instance if they have the ability to access an administrative service (e.g. SSH) on the VNF, either locally or remotely.
What software versions are affected by CVE-2020-1614?
CVE-2020-1614 affects Juniper JUNOS versions up to and including 19.2.
How can I fix CVE-2020-1614?
To fix CVE-2020-1614, update your Juniper JUNOS software to a version higher than 19.2.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/title
- agent/author
- agent/weakness
- agent/severity
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/juniper
- canonical/juniper junos
- version/juniper junos/19.2-r1-s1
- version/juniper junos/19.2-r1-s2
- version/juniper junos/19.2-r1-s3
- version/juniper junos/19.2-r1-s4
- canonical/juniper nfx250