6.8med
CVE-2018-0053
vSRX Series: A local authentication vulnerability may lead to full control of a vSRX instance while the system is booting.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.8
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 42%
Public exploits
0
none known
Summary
An authentication bypass vulnerability in the initial boot sequence of Juniper Networks Junos OS on vSRX Series may allow an attacker to gain full control of the system without authentication when the system is initially booted up. Affected releases are Juniper Networks Junos OS: 15.1X49 versions prior to 15.1X49-D30 on vSRX.
Exploit prediction (EPSS)
0.49% probability of exploitation in the next 30 days, higher than 42% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.8 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 6.8 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.0 | 6.8 | CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Juniper Networks Junos OS
Classification
- Weakness
- CWE-287 Improper Authentication
References
- kb.juniper.net /JSA10887 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1041854 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2018-0053
- NVD: CVE-2018-0053
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.