CVE-2018-0021
Junos OS: Short MacSec keys may allow man-in-the-middle attacks.
- Published
- Updated
- Reserved
- Assigned by
- juniper
Description
If all 64 digits of the connectivity association name (CKN) key or all 32 digits of the connectivity association key (CAK) key are not configured, all remaining digits will be auto-configured to 0. Hence, Juniper devices configured with short MacSec keys are at risk to an increased likelihood that an attacker will discover the secret passphrases configured for these keys through dictionary-based and brute-force-based attacks using spoofed packets. Affected releases are Juniper Networks Junos OS: 14.1 versions prior to 14.1R10, 14.1R9; 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R4-S9, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D100; 15.1X53 versions prior to 15.1X53-D59; 16.1 versions prior to 16.1R3-S8, 16.1R4-S8, 16.1R5; 16.2 versions prior to 16.2R1-S6, 16.2R2; 17.1 versions prior to 17.1R2.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| juniperCNA (assigner) | 3.0 | High8.8 | CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.0 | High8.8 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.60% · top 51% of all CVEs (5 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
- weak encryption man-in-the-middle attack brute force attack dictionary attack
Affected products
- affected 14.1 – < 14.1R10, 14.1R9
- affected 14.1X53 – < 14.1X53-D47
- affected 15.1 – < 15.1R4-S9, 15.1R6-S6, 15.1R7
- affected 15.1X49 – < 15.1X49-D100
- affected 15.1X53 – < 15.1X53-D59
- affected 16.1 – < 16.1R3-S8, 16.1R4-S8, 16.1R5
- affected 16.2 – < 16.2R1-S6, 16.2R2
- affected 17.1 – < 17.1R2
What to do
Solution: The following software releases have been updated to resolve this specific issue: 14.1R9, 14.1X53-D47, 15.1R4-S9, 15.1R6-S6, 15.1R7, 15.1X49-D100, 15.1X53-D59, 16.1R3-S8, 16.1R4-S8, 16.1R5, 16.2R1-S6, 16.2R2, 17.1R2, 17.2R1 and all subsequent releases.
Workaround: Configure all 64 digits of a CKN. Configure all 32 digits of a CAK. See the junos task topic macsec for further information.
Exploitation: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
References (2)
- 1040789 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
- https://kb.juniper.net/JSA10854 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-0021)Record last updated .