CVE-2020-1614: NFX250 Series: Hardcoded credentials in the vSRX VNF instance.
A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to take control of the vSRX VNF instance if they have the ability to access an administrative service (e.g. SSH) on the VNF, either locally, or through the network. This issue only affects the NFX250 Series vSRX VNF. No other products or platforms are affected. This issue is only applicable to environments where the vSRX VNF root password has not been configured. This issue affects the Juniper Networks NFX250 Network Services Platform vSRX VNF instance on versions prior to 19.2R1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks NFX250 Series vSRX VNFto a version that resolves this vulnerability.Fixed in 19.2R1
Event History
Frequently Asked Questions
What is CVE-2020-1614?
CVE-2020-1614 is a Use of Hard-coded Credentials vulnerability that exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance.
How severe is CVE-2020-1614?
CVE-2020-1614 has a severity level of critical.
How can an attacker take control of the vSRX VNF instance through CVE-2020-1614?
An attacker can take control of the vSRX VNF instance if they have the ability to access an administrative service (e.g. SSH) on the VNF, either locally or remotely.
What software versions are affected by CVE-2020-1614?
CVE-2020-1614 affects Juniper JUNOS versions up to and including 19.2.
How can I fix CVE-2020-1614?
To fix CVE-2020-1614, update your Juniper JUNOS software to a version higher than 19.2.