Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws

Juniper Networks has launched out-of-band updates to handle higher-severity flaws in SRX Sequence and EX Sequence that could be exploited by a menace actor to consider control of inclined methods.

The vulnerabilities, tracked as CVE-2024-21619 and CVE-2024-21620, are rooted in the J-Web component and effect all versions of Junos OS. Two other shortcomings, CVE-2023-36846 and CVE-2023-36851, had been previously disclosed by the company in August 2023.

• CVE-2024-21619 (CVSS rating: 5.3) – A missing authentication vulnerability that could guide to exposure of delicate configuration facts
• CVE-2024-21620 (CVSS rating: 8.8) – A cross-website scripting (XSS) vulnerability that could lead to the execution of arbitrary commands with the target’s permissions by usually means of a specifically crafted ask for

Cybersecurity company watchTowr Labs has been credited with getting and reporting the issues. The two vulnerabilities have been addressed in the adhering to versions –

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

• CVE-2024-21619 – 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1, and all subsequent releases
• CVE-2024-21620 – 20.4R3-S10, 21.2R3-S8, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3-S1, 23.2R2, 23.4R2, and all subsequent releases

As non permanent mitigations right until the fixes are deployed, the firm is recommending that end users disable J-Web or limit entry to only trusted hosts.

It really is worth noting that each CVE-2023-36846 and CVE-2023-36851 had been added to the Known Exploited Vulnerabilities (KEV) catalog in November 2023 by the U.S. Cybersecurity and Infrastructure Security Company (CISA), primarily based on evidence of active exploitation.

Previously this month, Juniper Networks also transported fixes to comprise a critical vulnerability in the exact solutions (CVE-2024-21591, CVSS score: 9.8) that could permit an attacker to result in a denial-of-provider (DoS) or remote code execution and attain root privileges on the system.

Observed this short article exciting? Adhere to us on Twitter  and LinkedIn to study much more exclusive written content we submit.