CVE-2017-10615
Junos: Potential remote code execution vulnerability in PAM
- Published
- Updated
- Reserved
- Assigned by
- juniper
Description
A vulnerability in the pluggable authentication module (PAM) of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM. Affected Juniper Networks Junos OS releases are: 14.1 from 14.1R5 prior to 14.1R8-S4, 14.1R9; 14.1X53 prior to 14.1X53-D50 on EX and QFX series; 14.2 from 14.2R3 prior to 14.2R7-S8, 14.2R8; No other Junos OS releases are affected by this issue. No other Juniper Networks products are affected by this issue.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| juniperCNA (assigner) | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.0 | Critical9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 2.5% · top 16% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
- remote code execution vulnerability
- CWE-20 (opens in a new tab)All about CWE-20 and its CVEs
Affected products
- affected 14.1 from 14.1R5 prior to 14.1R8-S4, 14.1R9
- affected 14.1X53 prior to 14.1X53-D50
- affected 14.2 from 14.2R3 prior to 14.2R7-S8, 14.2R8
What to do
Workaround: There are no viable workarounds for this issue.
Workaround: It is good security practice to limit the exploitable attack surface of critical infrastructure networking equipment. Use access lists or firewall filters to limit access to the router only from trusted, administrative networks or hosts. The risk of malicious exploitation can be reduced by disabling services if they are not being used.
References (2)
- https://kb.juniper.net/JSA10818 (opens in a new tab)x_refsource_CONFIRMx_transferred
- 1040039 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-10615)Record last updated .