CVE-2015-7755
Juniper ScreenOS Improper Authentication Vulnerability
Description
CVE-2015-7755 is a critical improper authentication vulnerability in Juniper ScreenOS that allows remote attackers to obtain administrative access to affected firewall devices by entering a hardcoded backdoor password during SSH or Telnet sessions. Multiple ScreenOS 6.2.0r and 6.3.0r versions are affected by this unauthorized code that was discovered embedded in the firmware. With a CVSS v3.1 base score of 9.8, this Juniper ScreenOS backdoor enables complete device takeover without any prerequisites. CISA has added CVE-2015-7755 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 85.63% at the 99th percentile confirms extremely high exploitation likelihood, making it an urgent priority for any organization still running vulnerable ScreenOS versions.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| juniper | screenos | 6.3.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/(Third Party Advisory)
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713(Exploit, Vendor Advisory)
- http://twitter.com/cryptoron/statuses/677900647560253442(Broken Link)
- http://www.forbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unauthorized-code-to-network-gear/(Permissions Required)
- http://www.kb.cert.org/vuls/id/640184(Third Party Advisory)
- http://www.securityfocus.com/bid/79626(Broken Link)
- http://www.securitytracker.com/id/1034489(Broken Link)
- http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/(Third Party Advisory)
- https://adamcaudill.com/2015/12/17/much-ado-about-juniper/(Third Party Advisory)
- https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554(Vendor Advisory)
- https://github.com/hdm/juniper-cve-2015-7755(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7755(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2015-7755 is classified under CWE-287 (Improper Authentication), which occurs when software does not sufficiently prove that an actor's identity claim is correct. In the affected Juniper ScreenOS firmware, unauthorized code was introduced that accepts a hardcoded master password for administrative access via SSH or Telnet, completely bypassing the legitimate authentication mechanism. Any remote attacker who knows the backdoor password can authenticate as an administrator regardless of the configured credentials.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2015-7755 presents a catastrophic security risk for any network protected by affected Juniper ScreenOS firewalls. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no prior authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): Administrative access to a firewall grants the attacker the ability to view all firewall configurations, VPN credentials, network topology information, and traffic passing through the device. Integrity (High): With admin access, an attacker can modify firewall rules to allow unauthorized traffic, create VPN tunnels for persistent access, alter logging configurations to hide their activity, and pivot to internal network resources. Availability (High): The attacker can disable the firewall entirely, modify routing tables, or reset the device, causing network outages. The CVSS score of 9.8 (Critical) combined with the EPSS score of 85.63% underscores the extreme danger of this Juniper ScreenOS backdoor. The presence of a hardcoded password in network security infrastructure is particularly alarming because firewalls are the primary defense boundary.
Exploit Maturity
CVE-2015-7755 demonstrates very high exploit maturity. An exploit and proof-of-concept tool is publicly available via GitHub (hdm/juniper-cve-2015-7755), and the Juniper advisory itself contains exploit details including information about the hardcoded backdoor. CISA has confirmed active exploitation by adding this vulnerability to the Known Exploited Vulnerabilities catalog. The EPSS score of 85.63% at the 99th percentile indicates near-certain exploitation activity. The simplicity of exploitation — merely entering a known password during an SSH or Telnet session — means that no exploit development skill is required. The discovery of unauthorized code in a major network security vendor's firmware generated widespread concern about supply chain integrity and prompted extensive investigation by the security community.
Remediation
-
Upgrade ScreenOS immediately to a patched version. Juniper has released fixes for the affected versions: upgrade to 6.3.0r12b, 6.3.0r13b, 6.3.0r14b, 6.3.0r15b, 6.3.0r16b, 6.3.0r17b, 6.3.0r18b, 6.3.0r19b, or 6.3.0r21 depending on your current release train. ScreenOS 6.2.0r versions should upgrade to the latest available patched release.
-
Restrict management access as an immediate compensating control. Disable SSH and Telnet access from untrusted networks. Implement management ACLs that restrict administrative access to a dedicated management VLAN or specific trusted IP addresses only. If possible, disable Telnet entirely and use only SSH with key-based authentication.
-
Assume compromise if the device was running a vulnerable version while accessible from untrusted networks. The backdoor password has been widely analyzed and documented. Audit all firewall rule changes, VPN configurations, and administrative access logs. Check for unauthorized configuration modifications, new VPN tunnels, or changes to logging settings.
-
Rotate all credentials that may have been exposed. Change all administrative passwords, VPN pre-shared keys, and any certificates stored on the affected devices. Review and update authentication configurations for any systems that relied on the compromised firewall for access control.
-
Evaluate device replacement. Given the nature of this vulnerability (unauthorized code in firmware), organizations should consider migrating to actively supported and audited network security platforms as a long-term strategy. Maintain a strict firmware integrity verification process for all network security appliances.
Technical Details
CVE-2015-7755 is an improper authentication vulnerability caused by unauthorized code embedded in Juniper ScreenOS firmware. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that the vulnerability is network-accessible with no complexity, no authentication, and no user interaction required, with maximum impact across all CIA dimensions. The vulnerability is fundamentally a hardcoded backdoor password that was inserted into the ScreenOS authentication code at an unknown point. When an attacker initiates an SSH or Telnet session to a vulnerable ScreenOS device and enters this specific password, the authentication mechanism accepts it as valid for administrative access regardless of the configured user credentials. Affected versions include ScreenOS 6.2.0r15 through 6.2.0r18 and multiple 6.3.0r releases before their respective patch levels. The unauthorized code was discovered by Juniper during an internal code review in December 2015, and the security community subsequently reverse-engineered the backdoor password from the firmware. The CWE-287 classification reflects the complete failure of the authentication mechanism to properly validate user identity, as the backdoor password bypasses all normal authentication controls.
Frequently Asked Questions
Is CVE-2015-7755 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2015-7755 to the Known Exploited Vulnerabilities catalog. The EPSS score of 85.63% at the 99th percentile confirms extremely high exploitation activity. The backdoor password has been publicly analyzed, making exploitation trivial for any attacker.
What products are affected by CVE-2015-7755?
Juniper ScreenOS versions 6.2.0r15 through 6.2.0r18 and 6.3.0r12 through 6.3.0r20 (before their respective patched releases) are affected. The vulnerability is a hardcoded backdoor in the firmware that allows administrative access via SSH or Telnet.
How do I fix CVE-2015-7755?
Upgrade to a patched ScreenOS version: 6.3.0r12b, 6.3.0r13b, 6.3.0r14b, 6.3.0r15b, 6.3.0r16b, 6.3.0r17b, 6.3.0r18b, 6.3.0r19b, or 6.3.0r21. Immediately restrict management access to trusted IP addresses only. Assume any exposed device has been compromised and audit all configurations.
How severe is CVE-2015-7755?
CVE-2015-7755 is rated Critical with a CVSS v3.1 base score of 9.8. The vulnerability allows any remote attacker to gain full administrative control of affected Juniper ScreenOS firewalls using a hardcoded backdoor password. Its EPSS score of 85.63% at the 99th percentile confirms it is among the most exploited network device vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.