CVE-2016-1265: juniper networks junos os
Vulnerability summary
CVE-2016-1265 is a critical (CVSS 9.8) vulnerability in juniper networks junos os. EPSS estimates a 2.30% chance of exploitation in the next 30 days, higher than 82.9% of scored vulnerabilities.
Timeline
- 13-10-2017PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery (CSRF), default authentication credentials, information leak and command injection attack vectors. All versions of Juniper Networks Junos Space prior to 15.1R3 are affected.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.30%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.30% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-255Credentials Management ErrorsWeaknesses in this category are related to the management of credentials.
- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Affected systems
Juniper1 product
- junos_space≤ 15.1r2
Juniper networks1 product
- junos osall versions prior to 15.1R2
2 vendors · 2 products