CVE-2021-0253 — HIGH (7.8) — White Hats Nepal

Vulnerability Description

NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby allowing an attacker to elevate their privileges via the Junos Device Management Daemon (JDMD) process. This issue affects Juniper Networks Junos OS on NFX Series 17.2 version 17.2R1 and later versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R2-S5, 18.4R3-S5; 19.1 versions prior to 19.1R1-S3; 19.2 version 19.1R2 and later versions prior to 19.2R3; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R2-S2. 19.4 versions 19.4R3 and above. This issue does not affect Juniper Networks Junos OS versions prior to 17.2R1. This issue does not affect the JDMD as used by Junos Node Slicing such as External Servers use in conjunction with Junos Node Slicing and In-Chassis Junos Node Slicing on MX480, MX960, MX2008, MX2010, MX2020.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Juniper	Junos	17.2
Juniper	Nfx150	-
Juniper	Nfx250	-
Juniper	Nfx350	-

Related Weaknesses (CWE)

CWE-77

References

https://github.com/orangecertcc/security-research/security/advisories/GHSA-vrf9-ExploitThird Party Advisory
https://kb.juniper.net/JSA11146Vendor Advisory
https://github.com/orangecertcc/security-research/security/advisories/GHSA-vrf9-ExploitThird Party Advisory
https://kb.juniper.net/JSA11146Vendor Advisory

FAQ

What is CVE-2021-0253?

CVE-2021-0253 is a vulnerability with a CVSS score of 7.8 (HIGH). NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby allowing an attacker to elevate their privileges via the Junos Device Management D...

How severe is CVE-2021-0253?

CVE-2021-0253 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-0253?

Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Nfx150, Juniper Nfx250, Juniper Nfx350.