CVE-2016-1265

Summary

A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery (CSRF), default authentication credentials, information leak and command injection attack vectors. All versions of Juniper Networks Junos Space prior to 15.1R3 are affected.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OSall versions prior to 15.1R2affected

Weaknesses

  • Privilege escalation

Workarounds

Limit access to Junos Space from only trusted networks Use administrative jump boxes with no internet access and employ anti-scripting techniques. In addition to the recommendations listed above, it is good security practice to limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the devices administrative interfaces only from trusted, administrative networks or hosts.

ADP Enrichment

CVE Program Container

Additional References

References