Junos OS Evolved: ACX Series with Paragon Active Assurance Test Agent: A local high…
Priority LOW 29CWE-313Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A Cleartext Storage in a File on Disk vulnerability in Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on network devices allows a local, authenticated attacker with high privileges to read all other users login credentials. This issue affects only Juniper Networks Junos OS Evolved ACX Series devices using the Paragon Active Assurance Test Agent software installed on these devices from 23.1R1-EVO through 23.2R2-EVO. This issue does not affect releases before 23.1R1-EVO.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00136 3rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Juniper | Junos OS Evolved | 23.1R1-EVO – 23.2R2-EVO | — | No fix listed | CNA |
- Junos OS Evolved VendorJuniper Affected 23.1R1-EVO – 23.2R2-EVO Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:juniper:paragon_active_assurance_test_agent:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:23.1:-:*:*:*:*:*:* | 23.1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:23.1:r1:*:*:*:*:*:* | 23.1 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:23.1:r2:*:*:*:*:*:* | 23.1 r2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:23.1:r3:*:*:*:*:*:* | 23.1 r3 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:* | 23.2 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:* | 23.2 r1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:* | 23.2 r1-s1 | Vulnerable | Juniper |
| cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:* | 23.2 r1-s2 | Vulnerable | Juniper |
| cpe:2.3:h:juniper:acx5448:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
- cpe:2.3:a:juniper:paragon_active_assurance_test_agent:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:23.1:-:*:*:*:*:*:* Versions 23.1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:23.1:r1:*:*:*:*:*:* Versions 23.1 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:23.1:r2:*:*:*:*:*:* Versions 23.1 r2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:23.1:r3:*:*:*:*:*:* Versions 23.1 r3 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:* Versions 23.2 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:* Versions 23.2 r1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s1:*:*:*:*:*:* Versions 23.2 r1-s1 Vulnerable ·Juniper
- cpe:2.3:o:juniper:junos_os_evolved:23.2:r1-s2:*:*:*:*:*:* Versions 23.2 r1-s2 Vulnerable ·Juniper
- cpe:2.3:h:juniper:acx5448:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:juniper:acx5448-d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:acx5448-m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:acx7020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:acx7024:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:acx7024x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:acx710:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:acx7100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:acx7300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
| cpe:2.3:h:juniper:acx7509:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Juniper |
- cpe:2.3:h:juniper:acx5448-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:acx5448-m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:acx7020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:acx7024:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:acx7024x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:acx710:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:acx7100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:acx7300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
- cpe:2.3:h:juniper:acx7509:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-30406
- 2026-10-03 Alias added: GHSA-vgc6-c45c-9998
References
Advisory 3
More Juniper Junos Os Evolved vulnerabilities
- TI-2026-17602 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root CVSS 4.0CRITICAL 9.3
- TI-2026-17601 Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash CVSS 4.0MEDIUM 6.7
- TI-2023-04136 Improper input validation in Juniper Junos OS CVSS 3.1HIGH 7.5
- TI-2026-74215 Stack-based buffer overflow in Junos OS rpd triggered by BGP peers CVSS 4.0CRITICAL 9.3
- TI-2026-74211 Authentication bypass in Juniper J-Web allows pre-auth CGI execution CVSS 4.0CRITICAL 9.3
- TI-2021-00146 Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted. CVSS 3.1CRITICAL 10.0
Sources
- CVE-2024-30406 · CVE Program
- CVE-2024-30406 · NVD
- FIRST EPSS
- GHSA-vgc6-c45c-9998 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences