The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactive session and possibly gain administrative privileges.

This issue affects all Juniper Networks Junos OS Evolved versions after 18.4R1-EVO, prior to 20.2R1-EVO.

Console log out on disconnect is enabled via the following configuration stanza:

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was found during internal product security testing or research.

This issue has been assigned  CVE-2020-1666 .
 

The following software releases have been updated to resolve this specific issue: Junos OS Evolved 20.2R1-EVO and all subsequent releases.

This issue is being tracked as  1406238 .
 

Software releases or updates are available for download at https://www.juniper.net/support/downloads/ .
 

2020-10-14: Initial Publication

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2020-1666 at cve.mitre.org