CVE-2020-1666: juniper networks junos os evolved Improper Access Control
Vulnerability summary
CVE-2020-1666 is a high (CVSS 7.2) Improper Access Control vulnerability in juniper networks junos os evolved. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.5% of scored vulnerabilities.
Timeline
- 16-10-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactive session and possibly gain administrative privileges. This issue affects all Juniper Networks Junos OS Evolved versions after 18.4R1-EVO, prior to 20.2R1-EVO.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST6.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Affected systems
Juniper1 product
- junos_os_evolved19.2:r1 | 19.2:r2 | 19.3:r2 | 19.4:r1 | 19.4:r2 | 19.4:r2-s1 | 20.1:r1
Juniper networks1 product
- junos os evolved≥ unspecified, < 20.2R1-EVO
2 vendors · 2 products