Can you explain this vulnerability to me?

This vulnerability is a password aging issue in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved. It allows an authenticated, network-based attacker to access the device without enforcing the required password change. Specifically, users whose passwords have expired and who should be required to change their passwords can still log in using their correct but expired passwords because the policy mandating the password change is not enforced. However, users cannot log in with incorrect passwords.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can impact you by allowing users with expired passwords to bypass the password change requirement and gain access to the device. This could lead to unauthorized access if an attacker has valid credentials but should have been forced to update their password. It weakens the security posture by not enforcing password expiration policies, potentially increasing the risk of compromised accounts remaining active longer than intended.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, you should upgrade affected Junos OS and Junos OS Evolved devices to fixed versions that address the issue. Specifically, update to versions 22.4R3-S8 or later, 23.2R2-S4 or later, 23.4R2-S5 or later, 24.2R2-S1 or later, or 24.4R1-S3 or later for Junos OS, and the corresponding fixed versions for Junos OS Evolved. This will ensure the password aging policy is properly enforced and prevent unauthorized access using expired passwords.

Useful 0 Not Useful 0