CVE-2022-22154: Junos Fusion: A Satellite Device can be controlled by rewiring it to a foreign AD causing a DoS

Published Jan 19, 2022

Updated

In a Junos Fusion scenario an External Control of Critical State Data vulnerability in the Satellite Device (SD) control state machine of Juniper Networks Junos OS allows an attacker who is able to make physical changes to the cabling of the device to cause a denial of service (DoS). An SD can get rebooted and subsequently controlled by an Aggregation Device (AD) which does not belong to the original Fusion setup and is just connected to an extended port of the SD. To carry out this attack the attacker needs to have physical access to the cabling between the SD and the original AD. This issue affects: Juniper Networks Junos OS 16.1R1 and later versions prior to 18.4R3-S10; 19.1 versions prior to 19.1R3-S7; 19.2 versions prior to 19.2R3-S4. This issue does not affect Juniper Networks Junos OS versions prior to 16.1R1.

Affected Software

279 affected components

Juniper Junos=16.1-r1

Juniper Junos=16.1-r2

Juniper Junos=16.1-r3

Juniper Junos=16.1-r3-s10

Juniper Junos=16.1-r3-s11

Juniper Junos=16.1-r3-s8

Juniper Junos=16.1-r4

Juniper Junos=16.1-r4-s12

Juniper Junos=16.1-r4-s2

Juniper Junos=16.1-r4-s3

Juniper Junos=16.1-r4-s4

Juniper Junos=16.1-r4-s6

Juniper Junos=16.1-r4-s8

Juniper Junos=16.1-r4-s9

Juniper Junos=16.1-r5

Juniper Junos=16.1-r5-s4

Juniper Junos=16.1-r6

Juniper Junos=16.1-r6-s1

Juniper Junos=16.1-r6-s3

Juniper Junos=16.1-r6-s4

Juniper Junos=16.1-r6-s6

Juniper Junos=16.1-r7

Juniper Junos=16.1-r7-s2

Juniper Junos=16.1-r7-s3

Juniper Junos=16.1-r7-s4

Juniper Junos=16.1-r7-s5

Juniper Junos=16.1-r7-s6

Juniper Junos=16.1-r7-s7

Juniper Junos=16.1-r7-s8

Juniper Junos=16.1x65

Juniper Junos=16.1x65-d20

Juniper Junos=16.1x65-d30

Juniper Junos=16.1x65-d35

Juniper Junos=16.1x65-d40

Juniper Junos=16.1x65-d48

Juniper Junos=16.1x70

Juniper Junos=16.2

Juniper Junos=16.2-r1

Juniper Junos=16.2-r1-s6

Juniper Junos=16.2-r2

Juniper Junos=16.2-r2-s1

Juniper Junos=16.2-r2-s10

Juniper Junos=16.2-r2-s2

Juniper Junos=16.2-r2-s5

Juniper Junos=16.2-r2-s6

Juniper Junos=16.2-r2-s7

Juniper Junos=16.2-r2-s8

Juniper Junos=16.2-r2-s9

Juniper Junos=16.2-r3

Juniper Junos=17.1

Juniper Junos=17.1-r1

Juniper Junos=17.1-r1-s7

Juniper Junos=17.1-r2

Juniper Junos=17.1-r2-s1

Juniper Junos=17.1-r2-s10

Juniper Junos=17.1-r2-s11

Juniper Junos=17.1-r2-s2

Juniper Junos=17.1-r2-s3

Juniper Junos=17.1-r2-s4

Juniper Junos=17.1-r2-s5

Juniper Junos=17.1-r2-s6

Juniper Junos=17.1-r2-s7

Juniper Junos=17.1-r2-s8

Juniper Junos=17.1-r2-s9

Juniper Junos=17.1-r3

Juniper Junos=17.1-r3-s1

Juniper Junos=17.1-r3-s2

Juniper Junos=17.1-r3-s3

Juniper Junos=17.2

Juniper Junos=17.2-r1

Juniper Junos=17.2-r1-s1

Juniper Junos=17.2-r1-s2

Juniper Junos=17.2-r1-s3

Juniper Junos=17.2-r1-s4

Juniper Junos=17.2-r1-s5

Juniper Junos=17.2-r1-s6

Juniper Junos=17.2-r1-s7

Juniper Junos=17.2-r1-s8

Juniper Junos=17.2-r2

Juniper Junos=17.2-r2-s11

Juniper Junos=17.2-r2-s4

Juniper Junos=17.2-r2-s6

Juniper Junos=17.2-r2-s7

Juniper Junos=17.2-r3

Juniper Junos=17.2-r3-s1

Juniper Junos=17.2-r3-s2

Juniper Junos=17.2-r3-s3

Juniper Junos=17.2-r3-s4

Juniper Junos=17.2x75

Juniper Junos=17.2x75-d100

Juniper Junos=17.2x75-d102

Juniper Junos=17.2x75-d110

Juniper Junos=17.2x75-d50

Juniper Junos=17.2x75-d70

Juniper Junos=17.2x75-d90

Juniper Junos=17.2x75-d91

Juniper Junos=17.2x75-d92

Juniper Junos=17.3

Juniper Junos=17.3-r1

Juniper Junos=17.3-r1-s1

Juniper Junos=17.3-r1-s4

Juniper Junos=17.3-r2

Juniper Junos=17.3-r2-s1

Juniper Junos=17.3-r2-s2

Juniper Junos=17.3-r2-s3

Juniper Junos=17.3-r2-s4

Juniper Junos=17.3-r2-s5

Juniper Junos=17.3-r3

Juniper Junos=17.3-r3-s1

Juniper Junos=17.3-r3-s10

Juniper Junos=17.3-r3-s11

Juniper Junos=17.3-r3-s12

Juniper Junos=17.3-r3-s2

Juniper Junos=17.3-r3-s3

Juniper Junos=17.3-r3-s4

Juniper Junos=17.3-r3-s5

Juniper Junos=17.3-r3-s6

Juniper Junos=17.3-r3-s7

Juniper Junos=17.3-r3-s8

Juniper Junos=17.3-r3-s9

Juniper Junos=17.3-r4

Juniper Junos=17.4

Juniper Junos=17.4-r1

Juniper Junos=17.4-r1-s1

Juniper Junos=17.4-r1-s2

Juniper Junos=17.4-r1-s3

Juniper Junos=17.4-r1-s4

Juniper Junos=17.4-r1-s5

Juniper Junos=17.4-r1-s6

Juniper Junos=17.4-r1-s7

Juniper Junos=17.4-r2

Juniper Junos=17.4-r2-s1

Juniper Junos=17.4-r2-s10

Juniper Junos=17.4-r2-s11

Juniper Junos=17.4-r2-s12

Juniper Junos=17.4-r2-s13

Juniper Junos=17.4-r2-s2

Juniper Junos=17.4-r2-s3

Juniper Junos=17.4-r2-s4

Juniper Junos=17.4-r2-s5

Juniper Junos=17.4-r2-s6

Juniper Junos=17.4-r2-s7

Juniper Junos=17.4-r2-s8

Juniper Junos=17.4-r2-s9

Juniper Junos=17.4-r3

Juniper Junos=17.4-r3-s1

Juniper Junos=17.4-r3-s2

Juniper Junos=17.4-r3-s3

Juniper Junos=17.4-r3-s4

Juniper Junos=17.4-r3-s5

Juniper Junos=18.1

Juniper Junos=18.1-r

Juniper Junos=18.1-r1

Juniper Junos=18.1-r2

Juniper Junos=18.1-r2-s1

Juniper Junos=18.1-r2-s2

Juniper Junos=18.1-r2-s4

Juniper Junos=18.1-r3

Juniper Junos=18.1-r3-s1

Juniper Junos=18.1-r3-s10

Juniper Junos=18.1-r3-s11

Juniper Junos=18.1-r3-s12

Juniper Junos=18.1-r3-s13

Juniper Junos=18.1-r3-s2

Juniper Junos=18.1-r3-s3

Juniper Junos=18.1-r3-s4

Juniper Junos=18.1-r3-s5

Juniper Junos=18.1-r3-s6

Juniper Junos=18.1-r3-s7

Juniper Junos=18.1-r3-s8

Juniper Junos=18.1-r3-s9

Juniper Junos=18.1-r4

Juniper Junos=18.1x75

Juniper Junos=18.1x75-d10

Juniper Junos=18.2

Juniper Junos=18.2-r

Juniper Junos=18.2-r1

Juniper Junos=18.2-r1-s2

Juniper Junos=18.2-r1-s3

Juniper Junos=18.2-r1-s4

Juniper Junos=18.2-r1-s5

Juniper Junos=18.2-r2

Juniper Junos=18.2-r2-s1

Juniper Junos=18.2-r2-s2

Juniper Junos=18.2-r2-s3

Juniper Junos=18.2-r2-s4

Juniper Junos=18.2-r2-s5

Juniper Junos=18.2-r2-s6

Juniper Junos=18.2-r2-s7

Juniper Junos=18.2-r2-s8

Juniper Junos=18.2-r3

Juniper Junos=18.2-r3-s1

Juniper Junos=18.2-r3-s2

Juniper Junos=18.2-r3-s3

Juniper Junos=18.2-r3-s4

Juniper Junos=18.2-r3-s5

Juniper Junos=18.2-r3-s6

Juniper Junos=18.2-r3-s7

Juniper Junos=18.2-r3-s8

Juniper Junos=18.2x75

Juniper Junos=18.2x75-d12

Juniper Junos=18.2x75-d20

Juniper Junos=18.2x75-d30

Juniper Junos=18.2x75-d40

Juniper Junos=18.2x75-d411

Juniper Junos=18.2x75-d5

Juniper Junos=18.2x75-d50

Juniper Junos=18.2x75-d51

Juniper Junos=18.2x75-d60

Juniper Junos=18.2x75-d10

Juniper Junos=18.2x75-d30

Juniper Junos=18.3

Juniper Junos=18.3-r

Juniper Junos=18.3-r1

Juniper Junos=18.3-r1-s1

Juniper Junos=18.3-r1-s2

Juniper Junos=18.3-r1-s3

Juniper Junos=18.3-r1-s4

Juniper Junos=18.3-r1-s5

Juniper Junos=18.3-r1-s6

Juniper Junos=18.3-r2

Juniper Junos=18.3-r2-s1

Juniper Junos=18.3-r2-s2

Juniper Junos=18.3-r2-s3

Juniper Junos=18.3-r2-s4

Juniper Junos=18.3-r3

Juniper Junos=18.3-r3-s1

Juniper Junos=18.3-r3-s2

Juniper Junos=18.3-r3-s3

Juniper Junos=18.3-r3-s4

Juniper Junos=18.3-r3-s5

Juniper Junos=18.3-r3-s6

Juniper Junos=18.4

Juniper Junos=18.4-r1

Juniper Junos=18.4-r1-s1

Juniper Junos=18.4-r1-s2

Juniper Junos=18.4-r1-s3

Juniper Junos=18.4-r1-s4

Juniper Junos=18.4-r1-s5

Juniper Junos=18.4-r1-s6

Juniper Junos=18.4-r1-s7

Juniper Junos=18.4-r2

Juniper Junos=18.4-r2-s1

Juniper Junos=18.4-r2-s2

Juniper Junos=18.4-r2-s3

Juniper Junos=18.4-r2-s4

Juniper Junos=18.4-r2-s5

Juniper Junos=18.4-r2-s6

Juniper Junos=18.4-r2-s7

Juniper Junos=18.4-r2-s8

Juniper Junos=18.4-r3-s9

Juniper Junos=19.1

Juniper Junos=19.1-r1

Juniper Junos=19.1-r1-s1

Juniper Junos=19.1-r1-s2

Juniper Junos=19.1-r1-s3

Juniper Junos=19.1-r1-s4

Juniper Junos=19.1-r1-s5

Juniper Junos=19.1-r1-s6

Juniper Junos=19.1-r2

Juniper Junos=19.1-r2-s1

Juniper Junos=19.1-r2-s2

Juniper Junos=19.1-r3-s7

Juniper Junos=19.2

Juniper Junos=19.2-r1

Juniper Junos=19.2-r1-s1

Juniper Junos=19.2-r1-s2

Juniper Junos=19.2-r1-s3

Juniper Junos=19.2-r1-s4

Juniper Junos=19.2-r1-s5

Juniper Junos=19.2-r1-s6

Juniper Junos=19.2-r1-s7

Juniper Junos=19.2-r3-s4

Remediation

Information

The following software releases have been updated to resolve this specific issue: 18.4R3-S10, 19.1R3-S7, 19.2R3-S4, 19.3R1, and all subsequent releases.

Event History

Jan 19, 2022

CVE Published

via MITRE·12:20 AM

Data Sourced

via MITRE·12:20 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2022-22154?

CVE-2022-22154 has been classified with a high severity level due to its potential to cause a denial of service (DoS) in affected Juniper Networks devices.

How do I fix CVE-2022-22154?

To mitigate the effects of CVE-2022-22154, Juniper Networks recommends applying the appropriate software updates or patches provided for impacted versions of Junos OS.

Which Junos OS versions are affected by CVE-2022-22154?

CVE-2022-22154 affects multiple versions of Junos OS, including variations from 16.1 to 19.2.

Can CVE-2022-22154 be exploited remotely?

CVE-2022-22154 requires physical access to the affected device's cabling, making remote exploitation not feasible.

What kind of attacks can CVE-2022-22154 lead to?

Exploiting CVE-2022-22154 can result in a denial of service (DoS) attack, disrupting the normal operations of the affected Juniper Networks devices.