Junos OS: NFX350: Password hashes stored in world-readable format
Priority LOW 28CWE-256Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-256.
Summary
The Juniper Device Manager (JDM) container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes in the world-readable file /etc/passwd. This is not a security best current practice as it can allow an attacker with access to the local filesystem the ability to brute-force decrypt password hashes stored on the system. This issue affects Juniper Networks Junos OS on NFX350: 19.4 versions prior to 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2.
Why it matters now
EPSS 0.00253 16th percentileScored 2026-11-07
Fix Fixed Junos OS (Juniper Networks): 19.4R3, 20.1R1-S4, 20.1R2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Junos OS | 19.4 to before 19.4R3; 20.1 to before 20.1R1-S4, 20.1R2 | 19.4R3, 20.1R1-S4, 20.1R2 | Patch available | CNA |
- Junos OS VendorJuniper Affected 19.4 to before 19.4R3; 20.1 to before 20.1R1-S4, 20.1R2 Fixed in 19.4R3, 20.1R1-S4, 20.1R2 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:* | 19.4 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:* | 19.4 r1-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:19.4:r1-s2:*:*:*:*:*:* | 19.4 r1-s2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:19.4:r2:*:*:*:*:*:* | 19.4 r2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:* | 20.1 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:* | 20.1 r1-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:* | 20.1 r1-s2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:* | 20.1 r1-s3 | Vulnerable | Juniper |
| cpe:2.3:h:juniper:nfx350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
- cpe:2.3:o:juniper:junos:19.4:r1:*:*:*:*:*:* Versions 19.4 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:19.4:r1-s1:*:*:*:*:*:* Versions 19.4 r1-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:19.4:r1-s2:*:*:*:*:*:* Versions 19.4 r1-s2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:19.4:r2:*:*:*:*:*:* Versions 19.4 r2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:20.1:r1:*:*:*:*:*:* Versions 20.1 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:20.1:r1-s1:*:*:*:*:*:* Versions 20.1 r1-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:20.1:r1-s2:*:*:*:*:*:* Versions 20.1 r1-s2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos:20.1:r1-s3:*:*:*:*:*:* Versions 20.1 r1-s3 Vulnerable ·Juniper
- cpe:2.3:h:juniper:nfx350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
Remediation
- Fix · CNA Junos OS (Juniper Networks) Fixed in 19.4R3, 20.1R1-S4, 20.1R2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1669
- 2026-10-03 Alias added: GHSA-9pj7-q8h3-hrhp
References
Advisory 1
More Juniper Junos vulnerabilities
- TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
- TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
- TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
- TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
Sources
- CVE-2020-1669 · CVE Program
- CVE-2020-1669 · NVD
- FIRST EPSS
- GHSA-9pj7-q8h3-hrhp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences