Cyber Resilience

CVE-2024-39512

Juniper Junos Os Evolved 23.2 … 23.4

Published
10 July 2024
Modified
07 February 2025
Patch / advisory
View advisory
CVSS Score v4 7.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0022 12th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2024-39512 is a high-severity Improper Physical Access Control (CWE-1263) vulnerability in Juniper Junos Os Evolved. Its CVSS base score is 7.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Replication Through Removable Media (T1091); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to PE-2 (Physical Access Authorizations) and PE-3 (Physical Access Control) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An Improper Physical Access Control vulnerability in the console port control of Juniper Networks Junos OS Evolved allows an attacker with physical access to the device to get access to a user account. When the console cable is disconnected, the…

more

logged in user is not logged out. This allows a malicious attacker with physical access to the console to resume a previous session and possibly gain administrative privileges. This issue affects Junos OS Evolved: * from 23.2R2-EVO before 23.2R2-S1-EVO, * from 23.4R1-EVO before 23.4R2-EVO.

CWE(s)
CWE-1263NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1091 Replication Through Removable Media Lateral Movement
Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.
attack.mitre.org →
T1200 Hardware Additions Initial Access
Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access.
attack.mitre.org →
T1052 Exfiltration Over Physical Medium Exfiltration
Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.
attack.mitre.org →
T1052.001 Exfiltration over USB Exfiltration
Adversaries may attempt to exfiltrate data over a USB connected physical device.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-39534Same product: Juniper Junos Os Evolved
CVE-2023-22402Same product: Juniper Junos Os Evolved
CVE-2024-30403Same product: Juniper Junos Os Evolved
CVE-2024-39559Same product: Juniper Junos Os Evolved
CVE-2024-39520Same product: Juniper Junos Os Evolved
CVE-2024-21590Same product: Juniper Junos Os Evolved
CVE-2023-28983Same product: Juniper Junos Os Evolved
CVE-2023-22400Same product: Juniper Junos Os Evolved
CVE-2024-39557Same product: Juniper Junos Os Evolved
CVE-2024-47505Same product: Juniper Junos Os Evolved

Affected Assets

juniper
junos os evolved
23.2, 23.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

PE-3 Physical Access Control good match

Directly enforces physical access authorizations at entry points to restricted areas.

PE-2 Physical Access Authorizations good match

Maintains the authorized physical access list that the system must enforce.

PE-6 Monitoring Physical Access good match

Monitors physical access to detect unauthorized entry after the fact.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-06 full match
prevents

Directly requires managing, monitoring, and enforcing physical access to assets commensurate with risk.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.2 Physical entry full match
prevents

Specifies physical entry controls that prevent unauthorized actors from reaching protected information or assets.

A.7.1 Physical security perimeters mostly match
prevents

Defines physical perimeters that directly limit unauthorized physical access to restricted areas.

A.7.14 Secure disposal or re-use of equipment mostly match
prevents

Secure disposal prevents data exposure after equipment leaves controlled areas.

A.7.3 Securing offices, rooms and facilities mostly match
prevents

Requires securing offices, rooms and facilities to restrict physical access to areas containing sensitive information.

A.7.4 Physical security monitoring mostly match
finds

Monitoring supports detection but does not itself prevent unauthorized physical access.

A.7.8 Equipment siting and protection mostly match
prevents

Equipment siting helps reduce exposure but is secondary to access-control measures.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (2 rules)
  • V-248537 OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user mode and maintenance. prevents CWE-1263
  • V-248540 OL 8 operating systems booted with a BIOS must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263
RHEL 7 (2 rules)
  • V-204440 Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263
  • V-204438 Red Hat Enterprise Linux operating systems version 7.2 or newer with a Basic Input/Output System (BIOS) must require authentication upon booting into single-user and maintenance modes. prevents CWE-1263

References