TI-2024-20136 Aliases CVE-2024-30407 GHSA-wp5q-4qc3-582g

[Child CVE] JCNR and cRPD: Hard-coded SSH host keys in cRPD may allow Person-in-the-Middle (PitM) attacks

MEDIUM 43CWE-321Published 2024-04-12 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

The Use of a Hard-coded Cryptographic Key vulnerability in Juniper Networks Juniper Cloud Native Router (JCNR) and containerized routing Protocol Deamon (cRPD) products allows an attacker to perform Person-in-the-Middle (PitM) attacks which results in complete compromise of the container. Due to hardcoded SSH host keys being present on the container, a PitM attacker can intercept SSH traffic without being detected. This issue affects Juniper Networks JCNR: * All versions before 23.4. This issue affects Juniper Networks cRPD: * All versions before 23.4R1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00676 52nd percentileScored 2026-11-07

Fix Fixed cRPD (Juniper Networks, Inc.): 23.4R1Juniper Cloud Native Router (JCNR) (Juniper Networks, Inc.): 23.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Juniper	cRPD	before 23.4R1	23.4R1	Patch available	CNA
Juniper	Juniper Cloud Native Router (JCNR)	before 23.4	23.4	Patch available	CNA

cRPD VendorJuniper Affected before 23.4R1 Fixed in 23.4R1 Patch available CNA
Juniper Cloud Native Router (JCNR) VendorJuniper Affected before 23.4 Fixed in 23.4 Patch available CNA

CPE names CISA-ADP · 2

CPE	Versions	Role	Vendor
cpe:2.3:h:juniper:cloud_native_router::::::::	—	—	Juniper
cpe:2.3:a:juniper:crpd::::::::	—	—	Juniper

cpe:2.3:h:juniper:cloud_native_router:*:*:*:*:*:*:*:* Versions — — ·Juniper
cpe:2.3:a:juniper:crpd:*:*:*:*:*:*:*:* Versions — — ·Juniper

Remediation

Fix · CNA cRPD (Juniper Networks, Inc.) Fixed in 23.4R1
Fix · CNA Juniper Cloud Native Router (JCNR) (Juniper Networks, Inc.) Fixed in 23.4

Timeline

2026-10-02 Threatist record created from CVE-2024-30407
2026-10-03 Alias added: GHSA-wp5q-4qc3-582g

References

Advisory 2

Other 1

https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
TI-2015-06436 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before… KEVCVSS 3.1CRITICAL 9.8
TI-2022-20885 Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults CVSS 3.1CRITICAL 9.8
TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7

See all 1284 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences