Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Juniper Junos on SRX devices lets console reconnect after disconnect

CVE-2015-3002 · published 11 years ago
Summary

On certain Juniper SRX firewalls, the setting that should log out a user when the console cable is unplugged does not work correctly. This means someone standing nearby could plug in a console cable and regain administrative access. Upgrade the Junos software to the latest release for your device model to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
juniper junos 12.1x44
12.1x45
12.1x46
12.1x47
12.1x48
cpe:2.3:o:juniper:junos:12.1x44:*:*:*:*:*:*:*
Original advisory text
Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, and 12.3X48 before 12.3X48-D10 on SRX series devices does not properly enforce the log-out-on-disco...
Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D15, and 12.3X48 before 12.3X48-D10 on SRX series devices does not properly enforce the log-out-on-disconnect feature when configured in the [system port console] stanza, which allows physically proximate attackers to reconnect to the console port and gain administrative access by leveraging access to the device.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-17DEPRECATED: Code
Timeline
Published10 Apr 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-3002 · NVD
Track software like this
Free during beta