Juniper Networks Releases Critical Security Update for Routers

Juniper Networks has launched out-of-band security updates to address a critical security flaw that could direct to an authentication bypass in some of its routers.

The vulnerability, tracked as CVE-2024-2973, carries a CVSS rating of 10., indicating utmost severity.

“An Authentication Bypass Employing an Alternate Path or Channel vulnerability in Juniper Networks Session Clever Router or Conductor working with a redundant peer makes it possible for a network dependent attacker to bypass authentication and get comprehensive regulate of the machine,” the enterprise claimed in an advisory issued last week.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

According to Juniper Networks, the shortcoming impacts only individuals routers or conductors that are managing in large-availability redundant configurations. The list of impacted gadgets is mentioned below –

• Session Good Router (all versions before 5.6.15, from 6. prior to 6.1.9-lts, and from 6.2 right before 6.2.5-sts)
• Session Wise Conductor (all versions just before 5.6.15, from 6. prior to 6.1.9-lts, and from 6.2 before 6.2.5-sts)
• WAN Assurance Router (6. versions just before 6.1.9-lts and 6.2 variations just before 6.2.5-sts)

The networking machines maker, which was purchased out by Hewlett Packard Organization (HPE) for somewhere around $14 billion previously this calendar year, claimed it located no evidence of active exploitation of the flaw in the wild.

It also stated that it discovered the vulnerability all through inside item testing and that there are no workarounds that solve the issue.

“This vulnerability has been patched immediately on afflicted gadgets for MIST managed WAN Assurance routers connected to the Mist Cloud,” it more famous. “It is crucial to take note that the deal with is applied instantly on managed routers by a Conductor or on WAN assurance routers has no effect on details-aircraft features of the router.”

In January 2024, the organization also rolled out fixes for a critical vulnerability in the identical products and solutions (CVE-2024-21591, CVSS score: 9.8) that could permit an attacker to bring about a denial-of-services (DoS) or remote code execution and get hold of root privileges on the units.

With various security flaws influencing the firm’s SRX firewalls and EX switches weaponized by menace actors past yr, it can be vital that users implement the patches to secure against likely threats.

Located this short article appealing? Abide by us on Twitter  and LinkedIn to study much more distinctive information we submit.