CVE-2019-0074

Junos OS: NFX150 Series, QFX10K Series, EX9200 Series, MX Series, PTX Series: Path traversal vulnerability in NFX150 and NG-RE leads to information disclosure.

MEDIUM

5.5

CVSS Score

Published: October 9, 2019 at 07:26 PM UTC

Updated: June 17, 2026 at 02:07 AM UTC

6 products affected across 2 vendorsJunosQfx10008Qfx10016

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.4%

Description

A path traversal vulnerability in NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series devices with Next-Generation Routing Engine (NG-RE) allows a local authenticated user to read sensitive system files. This issue only affects NFX150 Series and QFX10K Series, EX9200 Series, MX Series and PTX Series with Next-Generation Routing Engine (NG-RE) which uses vmhost. This issue affects Juniper Networks Junos OS on NFX150 Series and QFX10K, EX9200 Series, MX Series and PTX Series with NG-RE and vmhost: 15.1F versions prior to 15.1F6-S12 16.1 versions starting from 16.1R6 and later releases, including the Service Releases, prior to 16.1R6-S6, 16.1R7-S3; 17.1 versions prior to 17.1R3; 17.2 versions starting from 17.2R1-S3, 17.2R3 and later releases, including the Service Releases, prior to 17.2R3-S1; 17.3 versions starting from 17.3R1-S1, 17.3R2 and later releases, including the Service Releases, prior to 17.3R3-S3; 17.4 versions starting from 17.4R1 and later releases, including the Service Releases, prior to 17.4R1-S6, 17.4R2-S2, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S3; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S2, 18.3R2; 18.4 versions prior to 18.4R1-S1, 18.4R2. This issue does not affect: Juniper Networks Junos OS 15.1 and 16.2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

15.1F ≤ v < 15.1F6-S1216.1R6 ≤ v < 16.1*17.1 ≤ v < 17.1R317.2R1-S3, 17.2R3 ≤ v < 17.2*17.3R1-S1, 17.3R2 ≤ v < 17.3*17.4R1 ≤ v < 17.4*18.1 ≤ v < 18.1R2-S4, 18.1R3-S318.2 ≤ v < 18.2R218.2X75 ≤ v < 18.2X75-D4018.3 ≤ v < 18.3R1-S2, 18.3R218.4 ≤ v < 18.4R1-S1, 18.4R215.1 f1 15.1 f2 15.1 f2-s1 15.1 f2-s2 15.1 f2-s3 15.1 f2-s4 15.1 f3 15.1 f4 15.1 f5 15.1 f6 15.1 f6-s3 15.1F 16.1 r6 16.1 r6-s1 16.1 r7 16.1R6 17.1 17.1 r1 17.1 r2-s1 17.1 r2-s10 17.1 r2-s2 17.1 r2-s3 17.1 r2-s4 17.1 r2-s5 17.1 r2-s6 17.1 r2-s7 17.2 17.2 r1-s2 17.2 r1-s4 17.2 r1-s7 17.2 r1-s8 17.2 r2-s6 17.2 r2-s7 17.2R1-S3 17.2R3 17.3 r1-s1 17.3 r2 17.3 r2-s1 17.3 r2-s2 17.3 r3 17.3R1-S1 17.3R2 17.4 r1 17.4 r1-s1 17.4 r1-s2 17.4 r1-s4 17.4 r1-s7 17.4 r2 17.4 r2-s1 17.4R1 18.1 18.1 r2 18.1 r2-s1 18.1 r2-s2 18.1 r3 18.1 r3-s2 18.2 18.2 r1-s5 18.2X7518.2x7518.2x75 d20 18.3 18.3 r1 18.3 r1-s1 18.3 r1-s3 18.4 18.4 r1 18.4 r1-s2

Vendor states this is fixed in 15.1 (unaffected)

Affected range stops below 15.1F6-S12, so it looks safe — our inference, not a vendor statement

Affected range stops below 16.1*, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 16.2 16.2 (unaffected)

Affected range stops below 17.1R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.2*, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.3*, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.4*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.1R2-S4, 18.1R3-S3, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.2R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.2X75-D40, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.3R1-S2, 18.3R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.4R1-S1, 18.4R2, so it looks safe — our inference, not a vendor statement

juniper-ex9200 (environment) · juniper-nfx150 (environment) · juniper-qfx10002 (environment) · juniper-qfx10008 (environment) · juniper-qfx10016 (environment)

Ex9200 · Juniperdevice

80%

All versions

Nfx150 · Juniperdevice

80%

All versions

Qfx10002 · Juniperdevice

80%

All versions

Qfx10008 · Juniperdevice

80%

All versions