Skip to main content
Apexward Pulse

Juniper · Auth bypass

Juniper ScreenOS Authentication Bypass Vulnerability

CVE-2015-7755

What this means

This is rated critical severity (9.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Juniper Screenos is in your estate, and treat that as the priority.

Full vendor description

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.

Scoring and exploitation

9.8/ 10
CVSS 3.1 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~61.1% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Juniper ScreenOS

Weaknesses

CWE-287

Affected products ()

  • Juniper Screenos
Show the raw CPE strings (4)
  • cpe:2.3:o:juniper:screenos:6.3.0:r17:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r18:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r19:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r20:*:*:*:*:*:*

References

20 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • Juniper ScreenOS Authentication Bypass Vulnerability

    Type Vulnerability

    Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorised remote administrative access to the device. Known-exploited catalogue reports exploitation in the wild.

    Juniper ScreenOS
    CVE-2015-7755+1