CVE-2024-21615

MEDIUM
Published Apr 12, 2024 Modified Feb 6, 2025 CWE-276

Description

An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system. On all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system. This issue affects: Junos OS: * all versions before 21.2R3-S7,  * from 21.4 before 21.4R3-S5,  * from 22.1 before 22.1R3-S5,  * from 22.2 before 22.2R3-S3,  * from 22.3 before 22.3R3-S2,  * from 22.4 before 22.4R3,  * from 23.2 before 23.2R1-S2. Junos OS Evolved:  * all versions before 21.2R3-S7-EVO,  * from 21.3 before 21.3R3-S5-EVO,  * from 21.4 before 21.4R3-S5-EVO,  * from 22.1 before 22.1R3-S5-EVO,  * from 22.2 before 22.2R3-S3-EVO,  * from 22.3 before 22.3R3-S2-EVO, * from 22.4 before 22.4R3-EVO,  * from 23.2 before 23.2R1-S2.

Is your site exposed to CVE-2024-21615?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.0
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-276 Incorrect Default Permissions

Affected Products

Vendor Product
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved
juniper junos_os_evolved

References

Frequently Asked Questions

What is CVE-2024-21615? +
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system. On all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system. This issue affects: Junos OS: * all versions before 21.2R3-S7,  * from 21.4 before 21.4R3-S5,  * from 22.1 before 22.1R3-S5,  * from 22.2 before 22.2R3-S3,  * from 22.3 before 22.3R3-S2,  * from 22.4 before 22.4R3,  * from 23.2 before 23.2R1-S2. Junos OS Evolved:  * all versions before 21.2R3-S7-EVO,  * from 21.3 before 21.3R3-S5-EVO,  * from 21.4 before 21.4R3-S5-EVO,  * from 22.1 before 22.1R3-S5-EVO,  * from 22.2 before 22.2R3-S3-EVO,  * from 22.3 before 22.3R3-S2-EVO, * from 22.4 before 22.4R3-EVO,  * from 23.2 before 23.2R1-S2. It has a CVSS v3.1 base score of 5.0 (MEDIUM).
How severe is CVE-2024-21615? +
CVE-2024-21615 has a CVSS v3.1 score of 5.0 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-21615? +
CVE-2024-21615 affects products from juniper, specifically: junos, junos_os_evolved. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-21615? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-21615 — free, no signup required.