CVE-2017-10616 — Contrail: hard coded credentials

Back Back to CVE browser

MEDIUM

Contrail: hard coded credentials

Published Oct 13, 2017

5.3

MEDIUM

CVSS 3.1

EPSS 1.30%

Description

The ifmap service that comes bundled with Juniper Networks Contrail releases uses hard coded credentials. Affected releases are Contrail releases 2.2 prior to 2.21.4; 3.0 prior to 3.0.3.4; 3.1 prior to 3.1.4.0; 3.2 prior to 3.2.5.0. CVE-2017-10616 and CVE-2017-10617 can be chained together and have a combined CVSSv3 score of 5.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).

Affected products

Vendor Juniper Networks Product Contrail Default
n/a
- Version
  2.2
  Status
  affected
  Constraints
  <2.21.4
- Version
  3.0
  Status
  affected
  Constraints
  <3.0.3.4
- Version
  3.1
  Status
  affected
  Constraints
  <3.1.4.0
- Version
  3.2
  Status
  affected
  Constraints
  <3.2.5.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Juniper Networks

Contrail

n/a

Version	Status	Constraints
2.2	affected	<2.21.4
3.0	affected	<3.0.3.4
3.1	affected	<3.1.4.0
3.2	affected	<3.2.5.0

Remediation

Vendor solution

The following software releases have been updated to resolve these specific issues: Contrail 2.21.4, 3.0.3.4, 3.1.4.0, 3.2.5.0 and all subsequent releases.

Metrics

1.30% 0.01300

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01300

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3
EPSS v4

Table of values (12 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.30% (0.01300)	69.40th	v5 (v2026.06.15)
Jun 15, 2026	1.30% (0.01300)	66.60th	v5 (v2026.06.15)
Mar 30, 2025	0.45% (0.00450)	60.78th	v4 (v2025.03.14)
Mar 29, 2025	2.99% (0.02987)	77.53th	v4 (v2025.03.14)
Mar 17, 2025	0.45% (0.00450)	61.59th	v4 (v2025.03.14)
Dec 12, 2024	0.09% (0.00091)	40.44th	v3 (v2023.03.01)
Sep 3, 2023	0.09% (0.00091)	37.84th	v3 (v2023.03.01)
Mar 7, 2023	0.10% (0.00099)	39.49th	v3 (v2023.03.01)
Mar 6, 2023	4.50% (0.04499)	88.81th	v2 (v2022.01.01)
Feb 4, 2022	4.50% (0.04499)	74.08th	v2 (v2022.01.01)
Feb 3, 2022	1.84% (0.01840)	47.83th	v5 (v2026.06.15)
Apr 14, 2021	1.84% (0.01840)	0.00th	v1

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (2)

https://github.com/orangecertcc/security-research/security/advisories/GHSA-qx9c-49m4-f3vj
Third Party Advisory
https://kb.juniper.net/JSA10819
Vendor Advisory

Link	Providers	Tags
https://github.com/orangecertcc/security-research/security/advisories/GHSA-qx9c-49m4-f3vj		Third Party Advisory
https://kb.juniper.net/JSA10819		Vendor Advisory