CVE-2019-0015 - Junos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections until reboot

Back Back to CVE browser

MEDIUM

Junos OS: SRX Series: Deleted dynamic VPN users are allowed to establish VPN connections until reboot

Published Jan 15, 2019

5.4

MEDIUM

CVSS 3.1

EPSS 0.81%

Description

A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.

Affected products

Vendor Juniper Networks Product Junos OS Default
n/a
- Version
  12.3X48
  Status
  affected
  Constraints
  <12.3X48-D75
- Version
  15.1X49
  Status
  affected
  Constraints
  <15.1X49-D150
- Version
  17.3
  Status
  affected
  Constraints
  <17.3R3
- Version
  17.4
  Status
  affected
  Constraints
  <17.4R2
- Version
  18.1
  Status
  affected
  Constraints
  <18.1R3
- Version
  18.2
  Status
  affected
  Constraints
  <18.2R2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Juniper Networks

Junos OS

n/a

Version	Status	Constraints
12.3X48	affected	<12.3X48-D75
15.1X49	affected	<15.1X49-D150
17.3	affected	<17.3R3
17.4	affected	<17.4R2
18.1	affected	<18.1R3
18.2	affected	<18.2R2

Remediation

Vendor solution

The following software releases have been updated to resolve this specific issue: Junos OS 12.3X48-D75, 15.1X49-D150, 17.3R3, 17.4R2, 18.1R3, 18.2R2, 18.3R1, and all subsequent releases.

Metrics

0.81% 0.00812

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.00812

Score over time

2021-2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (12 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	0.81% (0.00812)	55.50th	v5 (v2026.06.15)
Sep 20, 2026	0.81% (0.00812)	55.44th	v5 (v2026.06.15)
Jul 20, 2024	0.05% (0.00054)	22.36th	v3 (v2023.03.01)
Jun 20, 2024	0.05% (0.00054)	21.93th	v3 (v2023.03.01)
Mar 7, 2023	0.05% (0.00054)	19.90th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	4.50% (0.04499)	74.08th	v2 (v2022.01.01)
Feb 3, 2022	2.74% (0.02742)	63.06th	v1
Jan 6, 2022	2.74% (0.02742)	62.72th	v1
Jan 5, 2022	0.62% (0.00624)	46.35th	v5 (v2026.06.15)
Apr 14, 2021	0.62% (0.00624)	0.00th	v1

Weaknesses (1)

CWE-613

References (2)

http://www.securityfocus.com/bid/106668
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10915
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/106668		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10915		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner juniper

Published Jan 15, 2019

Updated Sep 16, 2024

Reserved Oct 11, 2018

Link CVE-2019-0015

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-0015

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-0015