An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices.

The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc. The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center.

This issue affects Paragon Active Assurance: 4.1.0, 4.2.0.

The following software releases have been updated to resolve this specific issue: Paragon Active Assurance 4.2.1, 4.3.0, and all subsequent versions.

This issue is being tracked as PAALS-1573.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).
 

2024-04-10 - Initial Publication
2024-09-13: Minor formatting change to CVSS field

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• supportportal.juniper.net/JSA79173 [juniper.net]
• https://www.cve.org/CVERecord?id=CVE-2024-30381