January 30, 2024 at 03:59AM
Juniper Networks released out-of-band updates for high-severity flaws in SRX and EX Series, addressing missing authentication and cross-site scripting vulnerabilities. watchTowr Labs discovered and reported the issues. Temporary mitigations include disabling J-Web or restricting access. Earlier critical vulnerability fixes were also shipped. U.S. CISA added previously disclosed vulnerabilities to the Known Exploited Vulnerabilities catalog.
Key Takeaways from Newsroom Vulnerability/Network Security Meeting Notes:
– Juniper Networks has released out-of-band updates to address high-severity flaws in SRX Series and EX Series, which could be exploited by a threat actor to take control of susceptible systems.
– The vulnerabilities, tracked as CVE-2024-21619 and CVE-2024-21620, are rooted in the J-Web component and affect all versions of Junos OS.
– Two other vulnerabilities, CVE-2023-36846 and CVE-2023-36851, were previously disclosed by the company in August 2023.
– CVE-2024-21619 is a missing authentication vulnerability with a CVSS score of 5.3, while CVE-2024-21620 is a cross-site scripting (XSS) vulnerability with a CVSS score of 8.8.
– watchTowr Labs discovered and reported the vulnerabilities.
– Mitigations until the fixes are deployed include disabling J-Web or restricting access to only trusted hosts.
– Both CVE-2023-36846 and CVE-2023-36851 were added to the Known Exploited Vulnerabilities (KEV) catalog in November 2023 by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), based on evidence of active exploitation.
– Juniper Networks also shipped fixes to contain CVE-2024-21591, a critical vulnerability in the same products with a CVSS score of 9.8, earlier this month.
Let me know if I can assist with anything else.