CVE-2020-1614: NFX250 Series: Hardcoded credentials in the vSRX VNF instance.

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-08 · updated 2026-06-17
Weakness: CWE-798

Description

A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF) instance, which allows an attacker to take control of the vSRX VNF instance if they have the ability to access an administrative service (e.g. SSH) on the VNF, either locally, or through the network. This issue only affects the NFX250 Series vSRX VNF. No other products or platforms are affected. This issue is only applicable to environments where the vSRX VNF root password has not been configured. This issue affects the Juniper Networks NFX250 Network Services Platform vSRX VNF instance on versions prior to 19.2R1.

Affected products

Juniper Junos OS: before 19.2; 19.2-r1-s1, 19.2-r1-s2, 19.2-r1-s3, 19.2-r1-s4 — fixed in 19.2

How to fix

Upgrade to a fixed version: Juniper Junos OS 19.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-1614 or the next vulnerability affects your stack