Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Vulnerability record

CVE-2015-7755

Juniper ScreenOS Improper Authentication Vulnerability

CriticalExploitation confirmedCISA KEV
What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run ScreenOS, fix it now.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

US federal civilian agencies must remediate by Oct 23, 2025.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

ProductVendorAffected versionsSource
ScreenOSJuniper6.3.0KEV

Sources: KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdateKEV

    CVE-2015-7755 scored CVSS 9.8: Juniper ScreenOS, Juniper ScreenOS Improper Authentication Vulnerability

    CISA lists this as exploited in the wild. Unpatched ScreenOS systems are exposed to active attacks now.

    Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References

  • supportportal.juniper.net https://supportportal.juniper.net/s/article/2015-12-Out-of-Cycle-Security-Bulletin-ScreenOS-Multiple-Security-…
  • nvd.nist.gov https://nvd.nist.gov/vuln/detail/CVE-2015-7755
  • arstechnica.com http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/
  • kb.juniper.net http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713
  • twitter.com http://twitter.com/cryptoron/statuses/677900647560253442
  • forbes.com http://www.forbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unauth…
  • kb.cert.org http://www.kb.cert.org/vuls/id/640184
  • securityfocus.com http://www.securityfocus.com/bid/79626
  • securitytracker.com http://www.securitytracker.com/id/1034489
  • wired.com http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/
  • adamcaudill.com https://adamcaudill.com/2015/12/17/much-ado-about-juniper/
  • forums.juniper.net https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
  • github.com https://github.com/hdm/juniper-cve-2015-7755
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7755