CVE-2015-7756 Weak cryptography in n/a
Remote attackers can decrypt VPN traffic by sniffing network data due to weak encryption in Juniper ScreenOS, exposing sensitive plaintext content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-7756?
CVE-2015-7756 is a medium-severity vulnerability in n/a, published on 19 Dec 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 makes it easier for remote attackers to discover the plaintext content of VPN sessions by sniffing the network for ciphertext data and conducting an unspecified decryption attack.
Weakness: CWE-310
Which versions are affected by CVE-2015-7756?
It affects 1 product.
Products include Juniper Screenos.
How do I fix CVE-2015-7756?
No fix has been published for CVE-2015-7756 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-7756 being exploited?
There is no known exploitation of CVE-2015-7756 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2015-7755 Juniper ScreenOS Improper Authentication
- CVE-2017-2336 ScreenOS: XSS vulnerability in ScreenOS Firewall
- CVE-2017-2335 ScreenOS: XSS vulnerability in ScreenOS Firewall
- CVE-2017-2337 ScreenOS: XSS vulnerability in ScreenOS Firewall
- CVE-2017-2338 ScreenOS: XSS vulnerability in ScreenOS Firewall
Sources
Also known as GHSA-fq6r-qhq8-2958.