CVE-2024-39512
Last modified
CVE-2024-39512 is a high-severity vulnerability rated 7/10 on the CVSS scale. An Improper Physical Access Control vulnerability in the console port control of Juniper Networks Junos OS Evolved allows an attacker with physical access to the device to get access to a user account. When the console cable is disconnected, the logged in user is not logged out. This allows a malicious attacker with physical access to the console to resume a previous session and possibly gain administrative privileges. This issue affects Junos OS Evolved: * from 23.2R2-EVO before 23.2R2-S1-EVO, * from 23.4R1-EVO before 23.4R2-EVO.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
An Improper Physical Access Control vulnerability in the console port control of Juniper Networks Junos OS Evolved allows an attacker with physical access to the device to get access to a user account. When the console cable is disconnected, the logged in user is not logged out. This allows a malicious attacker with physical access to the console to resume a previous session and possibly gain administrative privileges. This issue affects Junos OS Evolved: * from 23.2R2-EVO before 23.2R2-S1-EVO, * from 23.4R1-EVO before 23.4R2-EVO.
Metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Juniper | Junos Os Evolved | 23.2 | R2 |
| Juniper | Junos Os Evolved | 23.4 | R1 |
References
- https://supportportal.juniper.net/JSA82977Vendor Advisory
- https://supportportal.juniper.net/JSA82977Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-39512?
How severe is CVE-2024-39512?
How do I fix CVE-2024-39512?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-39507In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-39508In the Linux kernel, the following vulnerability has been re…4.7
- CVE-2024-39509In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2024-3951 PTC Codebeamer is vulnerable to a cross site scripting vuln…7.1
- CVE-2024-39510In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2024-39511An Improper Input Validation vulnerability in the 802.1X Aut…6.8
- CVE-2024-39513An Improper Input Validation vulnerability in the Packet For…6.8
- CVE-2024-39514An Improper Check or Handling of Exceptional Conditions vuln…7.1
- CVE-2024-39515An Improper Validation of Consistency within Input vulnerabi…8.7
- CVE-2024-39516An Out-of-Bounds Read vulnerability in the routing protocol…8.7
- CVE-2024-39517An Improper Check for Unusual or Exceptional Conditions vuln…7.1
- CVE-2024-39518A Heap-based Buffer Overflow vulnerability in the telemetry …8.7
Are you affected by CVE-2024-39512?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST