Description
On Juniper Networks EX and QFX Series, an authentication bypass vulnerability may allow a user connected to the console port to login as root without any password. This issue might only occur in certain scenarios: • At the first reboot after performing device factory reset using the command “request system zeroize”; or • A temporary moment during the first reboot after the software upgrade when the device configured in Virtual Chassis mode. This issue affects Juniper Networks Junos OS on EX and QFX Series: 14.1X53 versions prior to 14.1X53-D53; 15.1 versions prior to 15.1R7-S4; 15.1X53 versions prior to 15.1X53-D593; 16.1 versions prior to 16.1R7-S4; 17.1 versions prior to 17.1R2-S11, 17.1R3-S1; 17.2 versions prior to 17.2R3-S3; 17.3 versions prior to 17.3R2-S5, 17.3R3-S6; 17.4 versions prior to 17.4R2-S9, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R2; 18.3 versions prior to 18.3R1-S7, 18.3R2. This issue does not affect Juniper Networks Junos OS 12.3.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Juniper Networks Junos OS
12.3unaffected14.1X53 to < 14.1X53-D53affected15.1 to < 15.1R7-S4affected15.1X53 to < 15.1X53-D593affected16.1 to < 16.1R7-S4affected17.1 to < 17.1R2-S11, 17.1R3-S1affected17.2 to < 17.2R3-S3affected17.3 to < 17.3R2-S5, 17.3R3-S6affected17.4 to < 17.4R2-S9, 17.4R3affected18.1 to < 18.1R3-S8affected18.2 to < 18.2R2affected18.3 to < 18.3R1-S7, 18.3R2affected