CVE-2019-0035

When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on systems booted from an OAM (Operations, Administration, and Maintenance) volume, leading to a possible administrative bypass with physical access to the console. OAM volumes (e.g. flash drives) are typically instantiated as /dev/gpt/oam, or /oam for short. Password recovery, changing the root password from a console, should not have been allowed from an insecure console. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F6-S12, 15.1R7-S3; 15.1X49 versions prior to 15.1X49-D160; 15.1X53 versions prior to 15.1X53-D236, 15.1X53-D496, 15.1X53-D68; 16.1 versions prior to 16.1R3-S10, 16.1R6-S6, 16.1R7-S3; 16.1X65 versions prior to 16.1X65-D49; 16.2 versions prior to 16.2R2-S8; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R1-S8, 17.2R3-S1; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S6, 17.4R2-S2; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2. This issue does not affect Junos OS releases prior to 15.1.

• CWE-501
• CWE-522

• https://kb.juniper.net/JSA10924Vendor Advisory
• https://kb.juniper.net/JSA10924Vendor Advisory

Published

Apr 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-0029Juniper ATP Series Splunk credentials are logged in a file r…8.8
• CVE-2019-0030Juniper ATP uses DES and a hardcoded salt for password hashi…7.2
• CVE-2019-0031Specific IPv6 DHCP packets received by the jdhcpd daemon wil…7.5
• CVE-2019-0032A password management issue exists where the Organization au…7.8
• CVE-2019-0033A firewall bypass vulnerability in the proxy ARP service of …7.5
• CVE-2019-0034Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: T…
• CVE-2019-0036When configuring a stateless firewall filter in Junos OS, te…9.8
• CVE-2019-0037In a Dynamic Host Configuration Protocol version 6 (DHCPv6) …7.5
• CVE-2019-0038Crafted packets destined to the management interface (fxp0) …6.5
• CVE-2019-0039If REST API is enabled, the Junos OS login credentials are v…8.1
• CVE-2019-0040On Junos OS, rpcbind should only be listening to port 111 on…9.1
• CVE-2019-0041On EX4300-MP Series devices with any lo0 filters applied, tr…8.6