Juniper · ScreenOS
CVE-2015-7755
Juniper ScreenOS Improper Authentication Vulnerability
What it is
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.
CISA: Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 23, 2025
- Added to the CISA list
- October 2, 2025
- Published
- December 19, 2015
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 61% in the top 0.8% of all known vulnerabilities
- Weakness
- CWE-287
- More details
- NVD · CVE.org · CISA
All references (11)
- http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/
- http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/
- http://www.securitytracker.com/id/1034489
- http://www.kb.cert.org/vuls/id/640184
- https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
- https://github.com/hdm/juniper-cve-2015-7755
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713
- http://twitter.com/cryptoron/statuses/677900647560253442
- https://adamcaudill.com/2015/12/17/much-ado-about-juniper/
- http://www.forbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unaut…
- http://www.securityfocus.com/bid/79626
More exploited flaws from Juniper
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 13, 2025 | Improper Isolation or Compartmentalization | Junos OS | Medium 6.7 | 1.7% |
| Nov 13, 2023 | EX Series PHP External Variable Modification | Junos OS | Medium 5.3 | 90% |
| Nov 13, 2023 | EX Series and SRX Series PHP External Variable Modification | Junos OS | Critical 9.8 | 95% |
| Nov 13, 2023 | SRX Series Missing Authentication for Critical Function | Junos OS | Medium 5.3 | 93% |
| Nov 13, 2023 | EX Series Missing Authentication for Critical Function | Junos OS | Medium 5.3 | 83% |
| Nov 13, 2023 | SRX Series Missing Authentication for Critical Function | Junos OS | Medium 5.3 | 1.1% |
| Mar 25, 2022 | Path Traversal | Junos OS | High 8.8 | 4.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.