What is CVE-2021-31349?

CVE-2021-31349 is a critical-severity vulnerability in Juniper 128 Technology Session Smart Router, classified under Improper Authentication. CVSS score: 9.8/10. Published 2021-10-19.

How severe is CVE-2021-31349?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Auth bypass in Juniper 128 Technology Session Smart Router

CVE-2021-31349

The usage of an internal HTTP header created an authentication bypass vulnerability (CWE-287), allowing an attacker to view internal files, change settings, manipulate services and execute arbitrary code. This issue affects all Juniper Networks 128 Technology Session Smart Router versions prior to 4.5.11, and all versions of 5.0 up to and including 5.0.1.

Vulnerability class: Broken Authentication

EPSS: 0.017 (75.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Juniper 128_technology_session_smart_router
Juniper 128_technology_session_smart_router_firmware
Juniper Networks 128 Technology Session Smart Router — versions unspecified, 5.0

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

sirt@juniper.net (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2021-31349?: CVE-2021-31349 is a critical-severity vulnerability in Juniper 128 Technology Session Smart Router, classified under Improper Authentication. CVSS score: 9.8/10. Published 2021-10-19.
How severe is CVE-2021-31349?: Critical severity. CVSS v3 base score is 9.8 out of 10.