Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2017-10601— Junos OS: Insufficient authentication for user login when a specific system configuration error occurs.

EPSS 0.42% · P62
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2017-10601

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Junos OS: Insufficient authentication for user login when a specific system configuration error occurs.
Source: NVD (National Vulnerability Database)
Vulnerability Description
A specific device configuration can result in a commit failure condition. When this occurs, a user is logged in without being prompted for a password while trying to login through console, ssh, ftp, telnet or su, etc., This issue relies upon a device configuration precondition to occur. Typically, device configurations are the result of a trusted administrative change to the system's running configuration. The following error messages may be seen when this failure occurs: mgd: error: commit failed: (statements constraint check failed) Warning: Commit failed, activating partial configuration. Warning: Edit the router configuration to fix these errors. If the administrative changes are not made that result in such a failure, then this issue is not seen. No other Juniper Networks products or platforms are affected by this issue. Affected releases are Juniper Networks Junos OS 12.3 prior to 12.3R10, 12.3R11; 12.3X48 prior to 12.3X48-D20; 13.2 prior to 13.2R8; 13.3 prior to 13.3R7; 14.1 prior to 14.1R4-S12, 14.1R5, 14.1R6; 14.1X53 prior to 14.1X53-D30; 14.2 prior to 14.2R4; 15.1 prior to 15.1F2, 15.1F3, 15.1R2.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Juniper Junos OS 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Junos OS是美国瞻博网络（Juniper Networks）公司的一套专用于该公司的硬件系统的网络操作系统。该操作系统提供了安全编程接口和Junos SDK。 Juniper Junos OS中存在安全漏洞，该漏洞源于没有对登录的用户执行充分的身份验证。远程攻击者可利用该漏洞绕过身份验证，在目标系统上获取权限。以下版本受到影响：Juniper Junos OS 12.3版本，12.3X48版本，13.2版本，13.3版本，14.1版本，14.1X53版本，14.2版本，15.1版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
Juniper NetworksJunos OS 12.3 prior to 12.3R10, 12.3R11 -

II. Public POCs for CVE-2017-10601

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2017-10601

Please Login to view more intelligence information

Same Patch Batch · Juniper Networks · 2017-07-14 · 20 CVEs total

CVE-2017-2339ScreenOS: XSS vulnerability in ScreenOS Firewall
CVE-2017-2349SRX Series: Command injection vulnerability in SRX IDP feature.
CVE-2017-2348Junos OS: jdhcpd daemon crash due to invalid IPv6 UDP packets
CVE-2017-2347Junos: Denial of Service vulnerability in rpd daemon
CVE-2017-2346MS-MPC or MS-MIC crash when passing large fragmented traffic through an ALG
CVE-2017-2345Junos: snmpd denial of service upon receipt of crafted SNMP packet
CVE-2017-2344Junos: Buffer overflow in sockets library
CVE-2017-2343SRX Series: Hardcoded credentials in Integrated UserFW feature.
CVE-2017-2342SRX Series: MACsec failure to report errors
CVE-2017-2341Junos OS: VM to host privilege escalation in platforms with Junos OS running in a virtuali
CVE-2017-10602Junos OS: buffer overflow vulnerability in Junos CLI
CVE-2017-2338ScreenOS: XSS vulnerability in ScreenOS Firewall
CVE-2017-2337ScreenOS: XSS vulnerability in ScreenOS Firewall
CVE-2017-2336ScreenOS: XSS vulnerability in ScreenOS Firewall
CVE-2017-2335ScreenOS: XSS vulnerability in ScreenOS Firewall
CVE-2017-2314Junos: RPD crash due to malformed BGP OPEN message
CVE-2017-10605Junos: SRX Series denial of service vulnerability in flowd due to crafted DHCP packet
CVE-2017-10604Junos OS: SRX Series: Cluster configuration sync failures occur if the root user account i
CVE-2017-10603Junos OS: Local XML Injection through CLI command can lead to privilege escalation

IV. Related Vulnerabilities

Same product: Junos OS
Same vendor: Juniper Networks

V. Comments for CVE-2017-10601

No comments yet

Leave a comment