Juniper ScreenOS Improper Authentication Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2015-7755 · Published 19/12/2015 · updated 17/06/2026

Juniper ScreenOS Improper Authentication Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 02/10/2025. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
ScreenOS Juniper	Versions not published yet (product named by CISA KEV)

Description

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.

References

arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic · Third Party Advisory
kb.juniper.net/InfoCenter/index · Exploit
twitter.com/cryptoron/statuses/677900647560253442 · Broken Link
forbes.com/sites/thomasbrewster/2015/12/18/juniper-says-it-didnt-work-with-government-to-add-unauthorized-code-to-network-gear · Permissions Required
kb.cert.org/vuls/id/640184 · Third Party Advisory
securityfocus.com/bid/79626 · Broken Link
securitytracker.com/id/1034489 · Broken Link
wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors · Third Party Advisory
adamcaudill.com/2015/12/17/much-ado-about-juniper · Third Party Advisory
forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554 · Vendor Advisory
hdm/juniper-cve-2015-7755 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2015-7755

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free