CVE-2020-1614

NFX250 Series: Hardcoded credentials in the vSRX VNF instance.

Description

A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to take control of the vSRX VNF instance if they have the ability to access an administrative service (e.g. SSH) on the VNF, either locally, or through the network. This issue only affects the NFX250 Series vSRX VNF. No other products or platforms are affected. This issue is only applicable to environments where the vSRX VNF root password has not been configured. This issue affects the Juniper Networks NFX250 Network Services Platform vSRX VNF instance on versions prior to 19.2R1.

Remediation

Solution:

  • The following software releases have been updated to resolve this specific issue: NFX250 Series version 19.2R1, and all subsequent releases. By upgrading, the hard-coded password is removed from the configuration.

Workaround:

  • Configure a new password for the device by referring to https://www.juniper.net/documentation/en_US/release-independent/junos/topics/task/configuration/nfx250-configure-vsrx-internal-ip.html . Additionally, to reduce the risk of exploitability of this issue, customers may choose to implement firewall filters / ACLs to limit administrative access to the VNF vSRX instance to only trusted hosts, networks and administrators. Disable unnecessary services not required to administer the system, until such time that either a password change can take place, or the fixed software is applied during a maintenance window.

Category

10.0
CVSS
Severity: Critical
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.31%
Vendor Advisory juniper.net Vendor Advisory juniper.net
Affected: Juniper Networks Juniper Networks NFX Series Network Services Platform
Published at:
Updated at:

References

Link Tags
https://kb.juniper.net/JSA10997 vendor advisory
https://www.juniper.net/documentation/en_US/release-independent/junos/topics/task/configuration/nfx250-configure-vsrx-internal-ip.html vendor advisory

Frequently Asked Questions

What is the severity of CVE-2020-1614?
CVE-2020-1614 has been scored as a critical severity vulnerability.
How to fix CVE-2020-1614?
To fix CVE-2020-1614: The following software releases have been updated to resolve this specific issue: NFX250 Series version 19.2R1, and all subsequent releases. By upgrading, the hard-coded password is removed from the configuration.
Is CVE-2020-1614 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2020-1614 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2020-1614?
CVE-2020-1614 affects Juniper Networks Juniper Networks NFX Series Network Services Platform.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.