cyfenced.com →

[ CVE-2015-7755 · Published 19 Dec 2015 ]

Juniper ScreenOS Improper Authentication Vulnerability

Exploited · CISA KEV CVSS 9.8 EPSS 61%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2025-10-02
  • EPSS: 61% chance of exploitation in the next 30 days (higher than 99% of CVEs)
  • Critical severity: CVSS 9.8

[ Description ]Official description

Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.

CISA: Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 23 Oct 2025): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References