Critical severity · published Dec 19, 2015
CVE-2015-7755
Juniper ScreenOS Improper Authentication Vulnerability
In wildKEV
9.8
CVSS
61.1%
EPSS
Yes
On KEV
Description
Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)61.1% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 2, 2025
Federal remediation dueOct 23, 2025
Ransomware campaign useNot known
Affected products
Which versions
SC
Screenos · Juniper
6.3.0; 6.3.0; 6.3.0; 6.3.0 · source: NVD, KEV
In the news
VulnerabilityCritical
[CISA KEV] CVE-2015-7755: Juniper ScreenOS - Juniper ScreenOS Improper Authentication Vulnerability
Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.
SCScreenOSCVE-2015-7755
Oct 2, 2025·CISA KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7755
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7755
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
arstechnica.com
http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/
www.wired.com
http://www.wired.com/2015/12/juniper-networks-hidden-backdoors-show-the-risk-of-government-backdoors/
vdb-entry
http://www.securitytracker.com/id/1034489
third-party-advisory
http://www.kb.cert.org/vuls/id/640184
forums.juniper.net
https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
github.com
https://github.com/hdm/juniper-cve-2015-7755
More from Screenos
8.1
CVE-2015-7754
Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted…
7.5
CVE-2016-1268
The administrative web services interface in Juniper ScreenOS before 6.3.0r21 allows remote attackers to cause a denial of service (reboot) via a crafted SSL packet
6.5
CVE-2018-0014
Juniper Networks ScreenOS devices do not pad Ethernet packets with zeros, and thus some packets can contain fragments of system memory or data from previous packets
5.4
CVE-2017-2339
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to…
5.4
CVE-2017-2338
A persistent cross site scripting vulnerability in NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN running ScreenOS allows a user with the 'security' role to…