CVE-2021-0248: NFX Series: Hard-coded credentials allow an attacker to take control of any instance through administrative interfaces.

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-22 · updated 2026-06-17
Weakness: CWE-798

Description

This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in Juniper Networks Junos OS allows an attacker to take over any instance of an NFX deployment. This issue is only exploitable through administrative interfaces. This issue affects: Juniper Networks Junos OS versions prior to 19.1R1 on NFX Series. No other platforms besides NFX Series devices are affected.

Affected products

Juniper Junos OS: before 19.1; 19.1 — fixed in 19.1

How to fix

Upgrade to a fixed version: Juniper Junos OS 19.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-0248 or the next vulnerability affects your stack