CVE-2021-31349

CRITICAL

9.8

Description

The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published10/19/2021

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

juniper:128_technology_session_smart_routerjuniper:128_technology_session_smart_router_firmware

Weaknesses (CWE)

CWE-287

References

https://kb.juniper.net/JSA11256(sirt@juniper.net)

https://kb.juniper.net/JSA11256(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.