Juniper Networks has released security updates to fix a critical pre-auth remote code execution vulnerability in its SRX Series firewalls and EX Series switches.
Found in the devices' J-Web configuration interfaces and tracked as CVE-2024-21591, this critical security flaw can also be exploited by unauthenticated threat actors to get root privileges or launch denial-of-service attacks against unpatched devices.
Juniper added that its Security Incident Response Team has no evidence that the vulnerability is being exploited in the wild.
Admins are advised to immediately apply the security updates or upgrade JunOS to the latest release or, at least, disable the J-Web interface to remove the attack vector.
Another temporary workaround is to restrict J-Web access to only trusted network hosts until patches are deployed.
According to data from nonprofit internet security organization Shadowserver, more than 8,200 Juniper devices have their J-Web interfaces exposed online, most from South Korea.
CISA also warned in November of a Juniper pre-auth RCE exploit used in the wild, chaining four bugs tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847 and impacted the company's SRX firewalls and EX switches.
The alert came months after ShadowServer detected the first exploitation attempts on August 25, one week after Juniper released patches and as soon as watchTowr Labs released a proof-of-concept exploit.
In September, vulnerability intelligence firm VulnCheck found thousands of Juniper devices still vulnerable to attacks using this exploit chain.
The U.S. cybersecurity agency issued the first binding operational directive of the year last June, requiring federal agencies to secure their Internet-exposed or misconfigured networking equipment within a two-week window following discovery.
Sophos backports RCE fix after attacks on unsupported firewalls.
CISA warns of actively exploited Juniper pre-auth RCE exploit chain.
Ivanti warns critical EPM bug lets hackers hijack enrolled devices.
Ivanti releases patches for 13 critical Avalanche RCE flaws.
Microsoft discovers critical RCE flaw in Perforce Helix Core Server.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 12 Jan 2024 17:40:12 +0000