CVE-2024-30381
Severity CVSS v4.0:
HIGH
Type:
CWE-200
Information Leak / Disclosure
Publication date:
12/04/2024
Last modified:
16/01/2026
Description
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices.<br />
<br />
The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc. The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center.<br />
<br />
<br />
<br />
<br />
This issue affects Paragon Active Assurance: 4.1.0, 4.2.0.
Impact
Base Score 4.0
8.40
Severity 4.0
HIGH
Base Score 3.x
8.40
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:juniper:paragon_active_assurance_control_center:4.1.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:juniper:paragon_active_assurance_control_center:4.2.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page