CVE-2024-2973
Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running in high-availability redundant configurations are affected by this vulnerability. No other Juniper Networks products or platforms are affected by this issue. This issue affects: Session Smart Router: * All versions before 5.6.15, * from 6.0 before 6.1.9-lts, * from 6.2 before 6.2.5-sts. Session Smart Conductor: * All versions before 5.6.15, * from 6.0 before 6.1.9-lts, * from 6.2 before 6.2.5-sts. WAN Assurance Router: * 6.0 versions before 6.1.9-lts, * 6.2 versions before 6.2.5-sts.
How to fix
- Juniper Networks Session Smart Router5.6.15, 6.1.9-lts, 6.2.5-sts or later
- Juniper Networks Session Smart Conductor5.6.15, 6.1.9-lts, 6.2.5-sts or later
- Juniper Networks WAN Assurance Router6.1.9-lts, 6.2.5-sts or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Juniper Networks Session Smart Router | v < 5.6.15, 6.0 ≤ v < 6.1.9-lts, 6.2 ≤ v < 6.2.5-sts | 5.6.15, 6.1.9-lts, 6.2.5-sts |
| Juniper Networks Session Smart Conductor | v < 5.6.15, 6.0 ≤ v < 6.1.9-lts, 6.2 ≤ v < 6.2.5-sts | 5.6.15, 6.1.9-lts, 6.2.5-sts |
| Juniper Networks WAN Assurance Router | 6.0 ≤ v < 6.1.9-lts, 6.2 ≤ v < 6.2.5-sts | 6.1.9-lts, 6.2.5-sts |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.