CVE-2023-28972

An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass console access controls. When "set system ports console insecure" is enabled, root login is disallowed for Junos OS as expected. However, the root password can be changed using "set system root-authentication plain-text-password" on NFX Series systems, leading to a possible administrative bypass with physical access to the console. Password recovery, changing the root password from a console, should not have been allowed from an insecure console. This is similar to the vulnerability described in CVE-2019-0035 but affects different platforms and in turn requires a different fix. This issue affects Juniper Networks Junos OS on NFX Series: 19.2 versions prior to 19.2R3-S7; 19.3 versions prior to 19.3R3-S8; 19.4 versions prior to 19.4R3-S12; 20.2 versions prior to 20.2R3-S8; 20.4 versions prior to 20.4R3-S7; 21.1 versions prior to 21.1R3-S5; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S2; 22.1 versions prior to 22.1R3-S1; 22.2 versions prior to 22.2R2-S1, 22.2R3; 22.3 versions prior to 22.3R1-S2, 22.3R2.

• CWE-59

• https://supportportal.juniper.net/JSA70596Vendor Advisory
• https://supportportal.juniper.net/JSA70596Vendor Advisory

Published

Apr 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28966An Incorrect Default Permissions vulnerability in Juniper Ne…7.8
• CVE-2023-28967A Use of Uninitialized Resource vulnerability in the Border …7.5
• CVE-2023-28968An Improperly Controlled Sequential Memory Allocation vulner…5.3
• CVE-2023-2897The Brizy Page Builder plugin for WordPress is vulnerable to…5.3
• CVE-2023-28970An Improper Check or Handling of Exceptional Conditions vuln…6.5
• CVE-2023-28971An Improper Restriction of Communication Channel to Intended…7.2
• CVE-2023-28973An Improper Authorization vulnerability in the 'sysmanctl' s…7.1
• CVE-2023-28974An Improper Check for Unusual or Exceptional Conditions vuln…6.5
• CVE-2023-28975An Unexpected Status Code or Return Value vulnerability in t…4.6
• CVE-2023-28976An Improper Check for Unusual or Exceptional Conditions vuln…7.5
• CVE-2023-28978An Insecure Default Initialization of Resource vulnerability…5.3
• CVE-2023-28979An Improper Check for Unusual or Exceptional Conditions vuln…4.7