CVE-2021-0260

Junos OS: SNMP fails to properly perform authorization checks on incoming received SNMP requests.

State: Published
Severity: 7.3 High
Published: Apr 22, 2021
Updated: Sep 17, 2024
Reserved: Oct 27, 2020

Description

An improper authorization vulnerability in the Simple Network Management Protocol daemon (snmpd) service of Juniper Networks Junos OS leads an unauthenticated attacker being able to perform SNMP read actions, an Exposure of System Data to an Unauthorized Control Sphere, or write actions to OIDs that support write operations, against the device without authentication. This issue affects: Juniper Networks Junos OS: 17.2 version 17.2R1 and later versions; 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S12, 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R1-S8, 18.4R2-S5, 18.4R3; 19.1 versions prior to 19.1R2; 19.2 versions prior to 19.2R1-S6, 19.2R2; 19.3 versions prior to 19.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 17.2R1.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L	juniper

Weaknesses

CWE-285 Improper Authorization
CWE-497 Exposure of System Data to an Unauthorized Control Sphere

Affected Products

Product	Versions
Junos OSJuniper Networks	before 17.2R1Not affected 17.2R1 to before 17.2*Affected 17.3 to before 17.3R3-S9Affected 17.4 to before 17.4R2-S12, 17.4R3-S5Affected 18.1 to before 18.1R3-S13Affected 18.2 to before 18.2R3-S8Affected 18.3 to before 18.3R3-S5Affected 18.4 to before 18.4R1-S8, 18.4R2-S5, 18.4R3Affected 19.1 to before 19.1R2Affected 19.2 to before 19.2R1-S6, 19.2R2Affected 19.3 to before 19.3R2Affected

References

https://kb.juniper.net/JSA11151

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.