InfoSecBulletin Cybersecurity for mankind
Juniper Networks released security updates to fix a critical vulnerability in its SRX Series firewalls and EX Series switches. The vulnerability allows remote code execution (RCE) without authentication.
A critical security flaw named CVE-2024-21591 was found in devices’ J-Web configuration interfaces. It can be exploited by unauthenticated attackers to gain root privileges or launch denial-of-service (DoS) attacks on unpatched devices.
Cisco released security updates for two critical security flaws
OpenBAS: Cutting-edge breach and attack simulation platform
Critical Security Flaws Patched in Zyxel Networking Devices
CVE-2024-38811: CEV In VMware Fusion Unveiled
CERT-IN Warns Vulnerabilities in Palo Alto Networks applications
How Malaysia’s Data Centre Industry Poised for Growth
RansomHub exfiltrated data over 210 victims: US alert
Godzilla Fileless Backdoor Exploits Atlassian Confluence flaw
New Cicada ransomware targets VMware ESXi servers
Monday hits two UK bank apps causes outages
“This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory,” the company explained in a security advisory published Wednesday.
Juniper stated that they have found no evidence of the vulnerability being exploited in the real world.
The list of vulnerable Junos OS versions affected by the SRX Series and EX Series J-Web bug is:
Junos OS versions earlier than 20.4R3-S9
Junos OS 21.2 versions earlier than 21.2R3-S7
Junos OS 21.3 versions earlier than 21.3R3-S5
Junos OS 21.4 versions earlier than 21.4R3-S5
Junos OS 22.1 versions earlier than 22.1R3-S4
Junos OS 22.2 versions earlier than 22.2R3-S3
Junos OS 22.3 versions earlier than 22.3R3-S2
Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3
“The bug has been fixed in all subsequent Junos OS releases from 20.4R3-S9 onwards.”
Admins are advised to promptly update their security or upgrade JunOS to the latest version; alternatively, disable the J-Web interface to eliminate the attack possibility.
Another temporary workaround is to restrict J-Web access to only trusted network hosts until patches are deployed.
According to data from nonprofit internet security organization Shadowserver, more than 8,200 Juniper devices have their J-Web interfaces exposed online, most from South Korea (Shodan also tracks over 9,000).
In November, CISA warned about a Juniper exploit called Juniper pre-auth RCE. It is being used by hackers and consists of four bugs known as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847. This exploit affects Juniper’s SRX firewalls and EX switches.
