Junos Space: privilege escalation vulnerabilities in Junos Space

Published 9 y ago 2017-10-13 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · CNA

CISA KEV

not known exploited

EPSS

2.3%

percentile 83%

Public exploits

none known

A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery (CSRF), default authentication credentials, information leak and command injection attack vectors. All versions of Juniper Networks Junos Space prior to 15.1R3 are affected.

Exploit prediction (EPSS)

2.30% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Affected products

Juniper Networks Junos OS

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-255 Credentials Management Errors
CWE-352 Cross-Site Request Forgery

References

kb.juniper.net /JSA10727 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2016-1265
NVD: CVE-2016-1265

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.