CVE-2021-0232
Paragon Active Assurance: Authentication bypass vulnerability in Control Center
- Published
- Updated
- Reserved
- Assigned by
- juniper
Description
An authentication bypass vulnerability in the Juniper Networks Paragon Active Assurance Control Center may allow an attacker with specific information about the deployment to mimic an already registered Test Agent and access its configuration including associated inventory details. If the issue occurs, the affected Test Agent will not be able to connect to the Control Center. This issue affects Juniper Networks Paragon Active Assurance Control Center All versions prior to 2.35.6; 2.36 versions prior to 2.36.2.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| juniperCNA (assigner) | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H |
- EPSS (exploitation in 30 days)
- 1.0% · top 36% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.
Weakness
Affected products
Juniper Networks · Paragon Active Assurance
- affected unspecified – < 2.35.6
- affected 2.36 – < 2.36.2
What to do
Solution: The following software releases have been updated to resolve this specific issue: 2.35.6, 2.36.2, 3.0.0 and all subsequent releases.
Workaround: All “register-only” users in the system can be removed until software upgrade.
References (2)
- https://kb.juniper.net/JSA11127 (opens in a new tab)x_refsource_MISCx_transferred
- FEDORA-2021-761cda0b77 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2021-0232)Record last updated .