CVE-2022-22237CWE-287

Junos OS: Peers not configured for TCP-AO can establish a BGP or LDP session even if authentication is configured locally

Medium · published October 18, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

An Improper Authentication vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause an impact on confidentiality or integrity. A vulnerability in the processing of TCP-AO will allow a BGP or LDP peer not configured with authentication to establish a session even if the peer is locally configured to use authentication. This could lead to untrusted or unauthorized sessions being established. This issue affects Juniper Networks Junos OS: 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R2-S2, 21.3R3; 21.4 versions prior to 21.4R2-S1, 21.4R3; 22.1 versions prior to 22.1R1-S1, 22.1R2. This issue does not affect Juniper Networks Junos OS Evolved.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00485 · 40.8th percentile
Weakness
CWE-287 · Improper Authentication
Published
2022-10-18T02:46Z
EPSS history
Timeline
  • 18 OCT 02:46Z
    Junos OS: Peers not configured for TCP-AO can establish a BGP or LDP session even if authentication is configured locally
    cvelistv5