Junos OS Evolved: 'console log-out-on-disconnect' fails to terminate session on console cable disconnection
Priority LOW 29CWE-284Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactive session and possibly gain administrative privileges. This issue affects all Juniper Networks Junos OS Evolved versions after 18.4R1-EVO, prior to 20.2R1-EVO.
Why it matters now
EPSS 0.00328 26th percentileScored 2026-11-07
Fix Fixed Junos OS Evolved (Juniper Networks): 20.2R1-EVO
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Junos OS Evolved | before 20.2R1-EVO | 20.2R1-EVO | Patch available | CNA |
- Junos OS Evolved VendorJuniper Affected before 20.2R1-EVO Fixed in 20.2R1-EVO Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:juniper:junos_os_evolved:19.2:r1:*:*:*:*:*:* | 19.2 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:19.2:r2:*:*:*:*:*:* | 19.2 r2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:19.3:r2:*:*:*:*:*:* | 19.3 r2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:19.4:r1:*:*:*:*:*:* | 19.4 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:19.4:r2:*:*:*:*:*:* | 19.4 r2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:19.4:r2-s1:*:*:*:*:*:* | 19.4 r2-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:20.1:r1:*:*:*:*:*:* | 20.1 r1 | Vulnerable | Juniper |
- cpe:2.3:o:juniper:junos_os_evolved:19.2:r1:*:*:*:*:*:* Versions 19.2 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:19.2:r2:*:*:*:*:*:* Versions 19.2 r2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:19.3:r2:*:*:*:*:*:* Versions 19.3 r2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:19.4:r1:*:*:*:*:*:* Versions 19.4 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:19.4:r2:*:*:*:*:*:* Versions 19.4 r2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:19.4:r2-s1:*:*:*:*:*:* Versions 19.4 r2-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:20.1:r1:*:*:*:*:*:* Versions 20.1 r1 Vulnerable ·Juniper
Remediation
- Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 20.2R1-EVO
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1666
- 2026-10-03 Alias added: GHSA-62gf-43c6-cfmp
References
Advisory 1
More Juniper Junos Os Evolved vulnerabilities
- TI-2026-17602 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root CVSS 4.0CRITICAL 9.3
- TI-2026-17601 Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash CVSS 4.0MEDIUM 6.7
- TI-2023-04136 Improper input validation in Juniper Junos OS CVSS 3.1HIGH 7.5
- TI-2026-74215 Stack-based buffer overflow in Junos OS rpd triggered by BGP peers CVSS 4.0CRITICAL 9.3
- TI-2026-74211 Authentication bypass in Juniper J-Web allows pre-auth CGI execution CVSS 4.0CRITICAL 9.3
- TI-2021-00146 Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted. CVSS 3.1CRITICAL 10.0
Sources
- CVE-2020-1666 · CVE Program
- CVE-2020-1666 · NVD
- FIRST EPSS
- GHSA-62gf-43c6-cfmp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences