Until earlier this week, the support website for networking equipment vendor Juniper Networks was exposing potentially sensitive information tied to customer products, including which devices customers bought, as well as each product's warranty status, service contracts and serial numbers.
Juniper said it has since fixed the problem, and that the inadvertent data exposure stemmed from a recent upgrade to its support portal.
Sunnyvale, Calif. based Juniper Networks makes high-powered Internet routers and switches, and its products are used in some of the world's largest organizations.
Earlier this week KrebsOnSecurity heard from a reader responsible for managing several Juniper devices, who found he could use Juniper's customer support portal to find device and support contract information for other Juniper customers.
Logan George is a 17-year-old intern working for an organization that uses Juniper products.
George said he found the data exposure earlier this week by accident while searching for support information on a particular Juniper product.
George discovered that after logging in with a regular customer account, Juniper's support website allowed him to list detailed information about virtually any Juniper device purchased by other customers.
Searching on Amazon.com in the Juniper portal, for example, returned tens of thousands of records.
Each record included the device's model and serial number, the approximate location where it is installed, as well as the device's status and associated support contract information.
Columns not pictured include Serial Number, Software Support Reference number, Product, Warranty Expiration Date and Contract ID. George said the exposed support contract information is potentially sensitive because it shows which Juniper products are most likely to be lacking critical security updates.
In a written statement, Juniper said the data exposure was the result of a recent upgrade to its support portal.
The company has not yet responded to requests for information about exactly when those overly permissive user rights were introduced.
The changes may date back to September 2023, when Juniper announced it had rebuilt its customer support portal.
George told KrebsOnSecurity the back-end for Juniper's support website appears to be supported by Salesforce, and that Juniper likely did not have the proper user permissions established on its Salesforce assets.
In April 2023, KrebsOnSecurity published research showing that a shocking number of organizations - including banks, healthcare providers and state and local governments - were leaking private and sensitive data thanks to misconfigured Salesforce installations.
Nicholas Weaver, a researcher at University of California, Berkeley's International Computer Science Institute and lecturer at UC Davis, said the complexity layered into modern tech support portals leaves much room for error.
Last month, computer maker Hewlett Packard Enterprise announced it would buy Juniper Networks for $14 billion, reportedly to help beef up the 100-year-old technology company's artificial intelligence offerings.
Update, 11:01 a.m. ET: An earlier version of this story quoted George as saying he was able to see support information for the U.S. Department of Defense.
This Cyber News was published on krebsonsecurity.com. Publication date: Fri, 09 Feb 2024 15:40:23 +0000