CVE-2024-2973

The attacker exploits an alternate path or channel that does not require authentication, thereby bypassing standard access control mechanisms. The vulnerability is accessible remotely over the network without requiring any privileges or user interaction. The redundancy mechanism used in high-availability configurations creates an additional attack surface that is not adequately protected by authentication mechanisms.

The attacker gains full control over the vulnerable device, which includes the ability to modify configuration, intercept network traffic, and perform further lateral movement in the infrastructure. The compromise affects confidentiality, integrity, and availability of the system and related systems.

Software must be updated to the following versions: Session Smart Router and Session Smart Conductor — 5.6.15 or later, 6.1.9-lts or later (6.0/6.1 branch), 6.2.5-sts or later (6.2 branch); WAN Assurance Router — 6.1.9-lts or later, 6.2.5-sts or later. Details are available in the vendor advisory JSA83126. Devices not in high-availability configuration are not vulnerable.

Juniper Networks Session Smart Router: all versions before 5.6.15, versions 6.0 before 6.1.9-lts, versions 6.2 before 6.2.5-sts. Juniper Networks Session Smart Conductor: all versions before 5.6.15, versions 6.0 before 6.1.9-lts, versions 6.2 before 6.2.5-sts. Juniper Networks WAN Assurance Router: versions 6.0 before 6.1.9-lts, versions 6.2 before 6.2.5-sts. The vulnerability affects only devices operating in high-availability configuration with redundant peers.