CVE-2022-22251

cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges

State: Published
Severity: 7.8 High
Published: Oct 18, 2022
Updated: May 8, 2025
Reserved: Dec 21, 2021

Read the record on cve.org

Description

On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Juniper Networks Junos OS allows a local, low-privileged attacker to elevate their permissions to take control of any instance of a cSRX software deployment. This issue affects Juniper Networks Junos OS 20.2 version 20.2R1 and later versions prior to 21.2R1 on cSRX Series.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	juniper

Weaknesses

CWE-257 Storing Passwords in a Recoverable Format
CWE-275 Permission Issues

Affected Products

Product	Versions
Junos OSJuniper Networks	before 20.2R1Not affected 20.2R1 to before 20.2Affected 20.3R1 to before 20.3Affected 20.4R1 to before 20.4Affected 21.1R1 to before 21.1Affected

References

https://kb.juniper.net/JSA69908

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.