Skip to main content
Apexward Pulse

Juniper · Auth bypass

Juniper ScreenOS Authentication Bypass Vulnerability

CVE-2015-7756

What this means

The severity of this vulnerability has not been scored yet. There is no confirmed exploitation of it yet. Ask IT whether Juniper Screenos is in your estate.

Full vendor description

The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 makes it easier for remote attackers to discover the plaintext content of VPN sessions by sniffing the network for ciphertext data and conducting an unspecified decryption attack.

Scoring and exploitation

5.0/ 10
CVSS base scoreMedium

Exploitable over the network. No impact on confidentiality, integrity or availability is scored.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L

Impact

Longer bar: more harm

IntegrityNoneI:N
AvailabilityNoneA:N
Not reported
Exploited in the wild
Not confirmed in the
Not reported

Weaknesses

CWE-310

Affected products ()

  • Juniper Screenos
Show the raw CPE strings (12)
  • cpe:2.3:o:juniper:screenos:6.2.0r15:*:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.2.0r16:*:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.2.0r17:*:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.2.0r18:*:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r12:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r14:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r15:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r16:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r17:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r18:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r19:*:*:*:*:*:*
  • cpe:2.3:o:juniper:screenos:6.3.0:r20:*:*:*:*:*:*

References

18 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • Juniper ScreenOS Authentication Bypass Vulnerability

    Type Vulnerability

    Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorised remote administrative access to the device. Known-exploited catalogue reports exploitation in the wild.

    Juniper ScreenOS
    CVE-2015-7755+1