Unauthorized Access to Sensitive Information in Paragon Active Assurance Control Center

CVE-2024-30381

Summary

A vulnerability has been identified within the Juniper Networks Paragon Active Assurance Control Center that allows unauthorized access to sensitive information. Specifically, the issue resides in the 'netrounds-probe-login' daemon, also known as probe_serviced, which facilitates various operations related to the Test Agent Appliance. This daemon inadvertently exposes functions that allow network-adjacent attackers with root access to retrieve sensitive details about downstream devices by accessing an internal database object. This vulnerability affects specific versions of the Paragon Active Assurance, including versions 4.1.0 and 4.2.0, highlighting a significant security risk for users relying on this platform.

References