CVE-2020-1669CWE-256

Junos OS: NFX350: Password hashes stored in world-readable format

Medium · published October 16, 2020

CVSS v3.1
6.3
EPSS
0%
Percentile
15.9
In the wild
Unconfirmed
What it is

The Juniper Device Manager (JDM) container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes in the world-readable file /etc/passwd. This is not a security best current practice as it can allow an attacker with access to the local filesystem the ability to brute-force decrypt password hashes stored on the system. This issue affects Juniper Networks Junos OS on NFX350: 19.4 versions prior to 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.9th percentile
Weakness
CWE-256 · Plaintext Storage of a Password
Published
2020-10-16T20:31Z
EPSS history
Timeline
  • 16 OCT 20:31Z
    Junos OS: NFX350: Password hashes stored in world-readable format
    cvelistv5