Read the docs
TI-2017-07782 Aliases CVE-2017-10616GHSA-hhp8-q7c4-jx53

Contrail: hard coded credentials

Priority LOW 27CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

Why it matters now

EPSS 0.013 70th percentileScored 2026-11-07
Fix Fixed Contrail (Juniper Networks): 2.21.4, 3.0.3.4, 3.1.4.0 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperContrail2.2 to before 2.21.4; 3.0 to before 3.0.3.4; 3.1 to before 3.1.4.0; 3.2 to before 3.2.5.02.21.4, 3.0.3.4, 3.1.4.0, 3.2.5.0Patch availableCNA
  • Contrail VendorJuniper Affected 2.2 to before 2.21.4; 3.0 to before 3.0.3.4; 3.1 to before 3.1.4.0; 3.2 to before 3.2.5.0 Fixed in 2.21.4, 3.0.3.4, 3.1.4.0, 3.2.5.0 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:juniper:contrail:2.2:*:*:*:*:*:*:*2.2VulnerableJuniper
cpe:2.3:a:juniper:contrail:3.0:*:*:*:*:*:*:*3.0VulnerableJuniper
cpe:2.3:a:juniper:contrail:3.1:*:*:*:*:*:*:*3.1VulnerableJuniper
cpe:2.3:a:juniper:contrail:3.2:*:*:*:*:*:*:*3.2VulnerableJuniper
  • cpe:2.3:a:juniper:contrail:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Juniper
  • cpe:2.3:a:juniper:contrail:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Juniper
  • cpe:2.3:a:juniper:contrail:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Juniper
  • cpe:2.3:a:juniper:contrail:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Juniper

Remediation

  • Fix · CNA Contrail (Juniper Networks) Fixed in 2.21.4, 3.0.3.4, 3.1.4.0, 3.2.5.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Juniper Networks Contrail 2.21.4, 3.0.3.4 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2017-07783 Contrail: XML External Entity (XXE) vulnerabilityPriority LOW 27
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-10616
  2. 2026-10-03 Alias added: GHSA-hhp8-q7c4-jx53

References

Advisory 2

  • TI-2017-07783 Contrail: XML External Entity (XXE) vulnerability CVSS 3.1MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences