CVE-2024-30407

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-30407
The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router (JCNR) and containerized routing Protocol Deamon (cRPD) products allows an attacker to perform Person-in-the-Middle (PitM) attacks which results in complete compromise of the container. Due to hardcoded SSH host keys being present on the container, a PitM attacker can intercept SSH traffic without being detected.  This issue affects Juniper Networks JCNR: * All versions before 23.4. This issue affects Juniper Networks cRPD: * All versions before 23.4R1.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://supportportal.juniper.net/JSA79106
https://supportportal.juniper.net/JSA79107
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Configurations

No configuration.

History

16 May 2024, 21:16

Type Values Removed Values Added
Summary (en) The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router (JCNR) and containerized routing Protocol Deamon (cRPD) products allows an attacker to perform Person-in-the-Middle (PitM) attacks which results in complete compromise of the container. Due to hardcoded SSH host keys being present on the container, a PitM attacker can intercept SSH traffic without being detected.  This issue affects Juniper Networks JCNR: * All versions before 23.4. This issue affects Juniper Networks cRPD: * All versions before 23.4R1. (en) The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router (JCNR) and containerized routing Protocol Deamon (cRPD) products allows an attacker to perform Person-in-the-Middle (PitM) attacks which results in complete compromise of the container. Due to hardcoded SSH host keys being present on the container, a PitM attacker can intercept SSH traffic without being detected.  This issue affects Juniper Networks JCNR: * All versions before 23.4. This issue affects Juniper Networks cRPD: * All versions before 23.4R1.

15 Apr 2024, 13:15

Type Values Removed Values Added
Summary
  • (es) La vulnerabilidad del uso de una clave criptográfica codificada en Juniper Networks Juniper Cloud Native Router (JCNR) y los productos de protocolo de enrutamiento en contenedores Deamon (cRPD) permite a un atacante realizar ataques de persona en el medio (PitM) que resultan en un compromiso total del contenedor. Debido a que las claves de host SSH codificadas están presentes en el contenedor, un atacante de PitM puede interceptar el tráfico SSH sin ser detectado. Este problema afecta a Juniper Networks JCNR: * Todas las versiones anteriores a la 23.4. Este problema afecta al cRPD de Juniper Networks: * Todas las versiones anteriores a 23.4R1.

12 Apr 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-12 15:15

Updated : 2024-05-16 21:16

NVD link : CVE-2024-30407

Mitre link : CVE-2024-30407

CVE.ORG link : CVE-2024-30407

JSON object : View

Products Affected

No product.

CWE
CWE-321

Use of Hard-coded Cryptographic Key