CVE-2018-0035 : QFX5200 and QFX10002 devices that have been shipped with Junos OS 15.1X53-D21, 1

QFX5200 and QFX10002 devices that have been shipped with Junos OS 15.1X53-D21, 15.1X53-D30, 15.1X53-D31, 15.1X53-D32, 15.1X53-D33 and 15.1X53-D60 or have been upgraded to these releases using the .bin or .iso images may contain an unintended additional Open Network Install Environment (ONIE) partition. This additional partition allows the superuser to reboot to the ONIE partition which will wipe out the content of the Junos partition and its configuration. Once rebooted, the ONIE partition will not have root password configured, thus any user can access the console or SSH, using an IP address acquired from DHCP, as root without password. Once the device has been shipped or upgraded with the ONIE partition installed, the issue will persist. Simply upgrading to higher release via the CLI will not resolve the issue. No other Juniper Networks products or platforms are affected by this issue.

Published 2018-07-11 18:29:01

Updated 2019-10-09 23:31:03

Source Juniper Networks, Inc.

View at NVD, CVE.org

Products affected by CVE-2018-0035

Juniper » Junos » Version: 15.1x53 Update D33
cpe:2.3:o:juniper:junos:15.1x53:d33:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Qfx10002 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D32
cpe:2.3:o:juniper:junos:15.1x53:d32:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Qfx10002 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D30
cpe:2.3:o:juniper:junos:15.1x53:d30:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Qfx10002 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D21
cpe:2.3:o:juniper:junos:15.1x53:d21:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Qfx10002 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D60
cpe:2.3:o:juniper:junos:15.1x53:d60:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Qfx10002 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A
Juniper » Junos » Version: 15.1x53 Update D31
cpe:2.3:o:juniper:junos:15.1x53:d31:*:*:*:*:*:*
Matching versions
When used together with: Juniper » Qfx10002 » Version: N/A
When used together with: Juniper » Qfx5200 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-0035

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 60 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-0035

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
4.4	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H	0.8	3.6	Juniper Networks, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

References for CVE-2018-0035

http://www.securitytracker.com/id/1041336

Juniper Junos on QFX5200/QFX10002 Platforms Lets Local Superusers Cause Denial of Service Conditions on the Target System - SecurityTracker
Third Party Advisory;VDB Entry
https://kb.juniper.net/JSA10869

Juniper Networks - 2018-07 Security Bulletin: Junos OS: QFX5200 and QFX10002: Unintended ONIE partition was shipped with certain Junos OS .bin and .iso images (CVE-2018-0035)
Vendor Advisory

Jump to

Vulnerability Details : CVE-2018-0035

Products affected by CVE-2018-0035

Exploit prediction scoring system (EPSS) score for CVE-2018-0035

CVSS scores for CVE-2018-0035

References for CVE-2018-0035