CVE-2018-0044 in Junos
Summary
by MITRE
An insecure SSHD configuration in Juniper Device Manager (JDM) and host OS on Juniper NFX Series devices may allow remote unauthenticated access if any of the passwords on the system are empty. The affected SSHD configuration has the PermitEmptyPasswords option set to "yes". Affected releases are Juniper Networks Junos OS: 18.1 versions prior to 18.1R4 on NFX Series.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 06/04/2020
The vulnerability identified as CVE-2018-0044 represents a critical security flaw in Juniper Networks NFX Series devices that stems from an insecure Secure Shell Daemon (SSHD) configuration. This issue affects the Juniper Device Manager (JDM) and the underlying host operating system, creating a pathway for unauthorized remote access that bypasses normal authentication mechanisms. The vulnerability specifically targets devices running Junos OS version 18.1 prior to 18.1R4, where the SSHD service is configured with PermitEmptyPasswords set to "yes", effectively allowing any attacker to gain access to the system without providing valid credentials.
The technical implementation of this vulnerability involves the SSHD daemon configuration that permits authentication using empty passwords, a dangerous default that violates fundamental security principles. When the PermitEmptyPasswords option is enabled, the SSH service accepts connections from users who provide no password or an empty password string, creating an authentication bypass that can be exploited by remote attackers. This configuration essentially removes the password requirement for SSH access, making the device vulnerable to unauthorized access as long as at least one account on the system has an empty password. The vulnerability is particularly concerning because it does not require any authentication credentials to establish a connection, allowing for completely unauthenticated access to the device's management interface.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass potential system compromise and data exfiltration. Attackers who exploit this vulnerability can gain full administrative control over affected NFX Series devices, enabling them to modify configurations, install malicious software, monitor network traffic, and potentially use the compromised device as a pivot point for attacking other systems within the network. This vulnerability directly maps to CWE-310, which addresses cryptographic weakness, specifically the improper restriction of security-critical information. The issue also aligns with ATT&CK technique T1078 which covers valid accounts for lateral movement and persistence, as compromised systems can be used to establish footholds within networks. Organizations running affected Juniper NFX Series devices face significant risk of unauthorized access, especially in environments where default accounts or accounts with empty passwords may exist.
Mitigation strategies for CVE-2018-0044 require immediate configuration changes to disable empty password authentication and implement proper account management practices. The primary remediation involves modifying the SSHD configuration to set PermitEmptyPasswords to "no" and ensuring all system accounts have strong, non-empty passwords. Network administrators should also implement regular security audits to identify and disable accounts with empty passwords, particularly default accounts that may be present on the system. Additionally, organizations should enforce strict password policies, implement account lockout mechanisms, and regularly update their Junos OS to versions that address this vulnerability. The recommended approach includes disabling unnecessary services, implementing network segmentation, and monitoring SSH access logs for suspicious activity. This vulnerability underscores the importance of following security best practices such as those outlined in NIST SP 800-53 and ISO 27001, which emphasize the need for proper access control and authentication mechanisms to prevent unauthorized system access and maintain the confidentiality, integrity, and availability of networked systems.