CVE-2022-22251: cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges

Published Oct 18, 2022
·
Updated

On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Juniper Networks Junos OS allows a local, low-privileged attacker to elevate their permissions to take control of any instance of a cSRX software deployment. This issue affects Juniper Networks Junos OS 20.2 version 20.2R1 and later versions prior to 21.2R1 on cSRX Series.

Affected Software

2 affected components
Juniper Junos>=20.2<21.2
Juniper cSRX

Remediation

Information

The following software releases have been updated to resolve this specific issue: Junos OS 21.2R1, and all subsequent releases. Additionally, customers using Docker or Kubernetes must contact JTAC to receive additional guidance on applying commands manually to deployments to provide a complete fix.

Event History

Oct 18, 2022
CVE Published
via MITRE·02:46 AM
Data Sourced
via MITRE·02:46 AM
RemedyDescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2022-22251.

2

What is the title of this vulnerability?

The title of this vulnerability is 'On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format'.

3

What is the severity of CVE-2022-22251?

The severity of CVE-2022-22251 is high with a severity value of 7.8.

4

Which software is affected by CVE-2022-22251?

Juniper Networks Junos OS versions 20.2 to 21.2 are affected by CVE-2022-22251.

5

How can an attacker exploit CVE-2022-22251?

A local, low-privileged attacker can exploit CVE-2022-22251 to elevate their permissions and take control of any instance of a cSRX software.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203