CVE-2024-30406: acx710 — Fix

Description

A Cleartext Storage in a File on Disk vulnerability in Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on network devices allows a local, authenticated attacker with high privileges to read all other users login credentials. This issue affects only Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on these devices from 23.1R1-EVO through 23.2R2-EVO. This issue does not affect releases before 23.1R1-EVO.

Is your site exposed to CVE-2024-30406?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

Weakness Type (CWE)

CWE-313 CWE-313

Affected Products

Vendor	Product	Versions
juniper	paragon_active_assurance_test_agent	All
juniper	junos_os_evolved	All
juniper	junos_os_evolved	All
juniper	junos_os_evolved	All
juniper	junos_os_evolved	All
juniper	junos_os_evolved	All
juniper	junos_os_evolved	All
juniper	junos_os_evolved	All
juniper	junos_os_evolved	All
juniper	acx5448	All
juniper	acx5448-d	All
juniper	acx5448-m	All
juniper	acx7020	All
juniper	acx7024	All
juniper	acx7024x	All
juniper	acx710	All
juniper	acx7100	All
juniper	acx7300	All
juniper	acx7509	All

References

Advisories & Patches

https://supportportal.juniper.net/JSA79104 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N https://supportportal.juniper.net/JSA79104 https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Other References

https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/services-paa-test-agent.html https://www.juniper.net/documentation/us/en/software/junos/junos-install-upgrade-evo/topics/topic-map/paa-test-agent-install.html https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/services-paa-test-agent.html https://www.juniper.net/documentation/us/en/software/junos/junos-install-upgrade-evo/topics/topic-map/paa-test-agent-install.html

Frequently Asked Questions

What is CVE-2024-30406? +

A Cleartext Storage in a File on Disk vulnerability in Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on network devices allows a local, authenticated attacker with high privileges to read all other users login credentials. This issue affects only Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on these devices from 23.1R1-EVO through 23.2R2-EVO. This issue does not affect releases before 23.1R1-EVO. It has a CVSS v3.1 base score of 5.5 (MEDIUM).

How severe is CVE-2024-30406? +

CVE-2024-30406 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-30406? +

CVE-2024-30406 affects products from juniper, specifically: acx5448, acx5448-d, acx5448-m, acx7020, acx7024, acx7024x, acx710, acx7100, acx7300, acx7509, junos_os_evolved, paragon_active_assurance_test_agent. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-30406? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-8804

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on …

CVE-2025-5098 9.1

PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account …

CVE-2026-52783 8.2

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint userless OAuth …

CVE-2026-24349 7.1

A vulnerability has been identified in SIMATIC WinCC Unified PC Runtime V16 (All versions), SIMATIC WinCC Unified PC Runtime V17 …

CVE-2025-4397 6.8

Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials …

CVE-2024-20448 6.3

A vulnerability in the Cisco Nexus Dashboard Fabric Controller (NDFC) software, formerly Cisco Data Center Network Manager (DCNM), could allow …

CVE-2024-30406