CVE-2021-0266 describes a critical vulnerability in Juniper Networks Junos OS on cSRX Series software, stemming from the use of multiple hard-coded cryptographic keys. This flaw allows an unauthenticated attacker to gain full control over any cSRX instance via device management services. With a CVSS score of 9.8 (Critical), the vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the inherent severity warrants immediate patching for affected versions prior to 20.2R3, 20.3R2, and 20.4R2.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 20.2R3CPE match | cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | ||
>= 20.3, < 20.3R2CPE match | cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | ||
>= 20.4, < 20.4R2CPE match | cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* | ||
20.2CPE matchmatch criteria | cpe:2.3:o:juniper:junos:20.2:r1:*:*:*:*:*:* | ||
20.2CPE matchmatch criteria | cpe:2.3:o:juniper:junos:20.2:r1-s1:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.