critical9.8Known exploited
CVE-2015-7755
Juniper ScreenOS Improper Authentication Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2025-10-02. Federal due date: 2025-10-23.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Juniper | Screenos | Version 6.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713
- http://twitter.com/cryptoron/statuses/677900647560253442
- http://www.forbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unauthorized-code-to-network-gear/
- http://www.kb.cert.org/vuls/id/640184
- http://www.securityfocus.com/bid/79626
- http://www.securitytracker.com/id/1034489
- http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/
- https://adamcaudill.com/2015/12/17/much-ado-about-juniper/
- https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
- https://github.com/hdm/juniper-cve-2015-7755
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7755