CVE-2026-33779

EPSS 0.03%
Veröffentlicht 09.04.2026 22:16:26
Zuletzt bearbeitet 17.04.2026 17:21:52
Quelle sirt@juniper.net
CVE-Watchlists
Login
Unerledigt
Login

Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication

An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device and get access to confidential information and potentially modify it.

When an SRX device is provisioned to connect to Security Director (SD) cloud, it doesn't perform sufficient verification of the received server certificate. This allows a PITM to intercept the communication between the SRX and SD cloud and access credentials and other sensitive information.

This issue affects Junos OS:
  *  all versions before 22.4R3-S9,
  *  23.2 versions before 23.2R2-S6,
  *  23.4 versions before 23.4R2-S7,
  *  24.2 versions before 24.2R2-S3,
  *  24.4 versions before 24.4R2-S2,
  *  25.2 versions before 25.2R1-S2, 25.2R2.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 55 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Juniper ≫ Junos Version < 22.4

   Juniper ≫ Srx1500 Version-
   Juniper ≫ Srx1600 Version-
   Juniper ≫ Srx2300 Version-
   Juniper ≫ Srx300 Version-
   Juniper ≫ Srx320 Version-
   Juniper ≫ Srx340 Version-
   Juniper ≫ Srx345 Version-
   Juniper ≫ Srx380 Version-
   Juniper ≫ Srx4100 Version-
   Juniper ≫ Srx4120 Version-
   Juniper ≫ Srx4200 Version-
   Juniper ≫ Srx4300 Version-
   Juniper ≫ Srx4600 Version-
   Juniper ≫ Srx4700 Version-
   Juniper ≫ Srx5400 Version-
   Juniper ≫ Srx5600 Version-
   Juniper ≫ Srx5800 Version-

Juniper ≫ Junos Version22.4 Update-

Juniper ≫ Junos Version22.4 Updater1

Juniper ≫ Junos Version22.4 Updater1-s1

Juniper ≫ Junos Version22.4 Updater1-s2

Juniper ≫ Junos Version22.4 Updater2

Juniper ≫ Junos Version22.4 Updater2-s1

Juniper ≫ Junos Version22.4 Updater2-s2

Juniper ≫ Junos Version22.4 Updater3

Juniper ≫ Junos Version22.4 Updater3-s1

Juniper ≫ Junos Version22.4 Updater3-s2

Juniper ≫ Junos Version22.4 Updater3-s3

Juniper ≫ Junos Version22.4 Updater3-s4

Juniper ≫ Junos Version22.4 Updater3-s5

Juniper ≫ Junos Version22.4 Updater3-s6

Juniper ≫ Junos Version22.4 Updater3-s7

Juniper ≫ Junos Version22.4 Updater3-s8

Juniper ≫ Junos Version23.2 Update-

Juniper ≫ Junos Version23.2 Updater1

Juniper ≫ Junos Version23.2 Updater1-s1

Juniper ≫ Junos Version23.2 Updater1-s2

Juniper ≫ Junos Version23.2 Updater2

Juniper ≫ Junos Version23.2 Updater2-s1

Juniper ≫ Junos Version23.2 Updater2-s2

Juniper ≫ Junos Version23.2 Updater2-s3

Juniper ≫ Junos Version23.2 Updater2-s4

Juniper ≫ Junos Version23.2 Updater2-s5

Juniper ≫ Junos Version23.4 Update-

Juniper ≫ Junos Version23.4 Updater1

Juniper ≫ Junos Version23.4 Updater1-s1

Juniper ≫ Junos Version23.4 Updater1-s2

Juniper ≫ Junos Version23.4 Updater2

Juniper ≫ Junos Version23.4 Updater2-s1

Juniper ≫ Junos Version23.4 Updater2-s2

Juniper ≫ Junos Version23.4 Updater2-s3

Juniper ≫ Junos Version23.4 Updater2-s4

Juniper ≫ Junos Version23.4 Updater2-s5

Juniper ≫ Junos Version23.4 Updater2-s6

Juniper ≫ Junos Version24.2 Update-

Juniper ≫ Junos Version24.2 Updater1

Juniper ≫ Junos Version24.2 Updater1-s1

Juniper ≫ Junos Version24.2 Updater1-s2

Juniper ≫ Junos Version24.2 Updater2

Juniper ≫ Junos Version24.2 Updater2-s1

Juniper ≫ Junos Version24.2 Updater2-s2

Juniper ≫ Junos Version24.4 Update-

Juniper ≫ Junos Version24.4 Updater1

Juniper ≫ Junos Version24.4 Updater1-s2

Juniper ≫ Junos Version24.4 Updater1-s3

Juniper ≫ Junos Version24.4 Updater2

Juniper ≫ Junos Version24.4 Updater2-s1

Juniper ≫ Junos Version25.2 Update-

Juniper ≫ Junos Version25.2 Updater1

Juniper ≫ Junos Version25.2 Updater1-s1

Juniper ≫ Junos Version25.2 Updater2

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.03%	0.074

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
sirt@juniper.net	6.5	2.2	4.2	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
sirt@juniper.net	8.3	0	0	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:M/U:X

CWE-296 Improper Following of a Certificate's Chain of Trust

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

https://kb.juniper.net/JSA107823

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2026-33779

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-33779

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-33779

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-33779