CVE-2023-28971— Paragon Active Assurance: Enabling the timescaledb enables IP forwarding
Quick assessment
Affected
Juniper Networks Paragon Active Assurance
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Juniper Networks Paragon Active Assurance是美国瞻博网络（Juniper Networks）公司的一种可编程的测试和服务保证解决方案。使用基于软件和流量生成的测试代理，可作为 SaaS 解决方案从云中轻松使用和交付，或在 NFV 环境中本地部署。 Juniper Networks Paragon Active Assurance 4.1.2之前版本存在安全漏洞，该漏洞源于网络接口数据包处理异常情况时检查或处理不当，攻击者利用该漏洞可以向设备发送特定数据包导致内核崩溃
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-28971
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Paragon Active Assurance: Enabling the timescaledb enables IP forwarding
Source: CVE Program / CVE List V5
Vulnerability Description
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the timescaledb feature of Juniper Networks Paragon Active Assurance (PAA) (Formerly Netrounds) allows an attacker to bypass existing firewall rules and limitations used to restrict internal communcations. The Test Agents (TA) Appliance connects to the Control Center (CC) using OpenVPN. TA's are assigned an internal IP address in the 100.70.0.0/16 range. Firewall rules exists to limit communication from TA's to the CC to specific services only. OpenVPN is configured to not allow direct communication between Test Agents in the OpenVPN application itself, and routing is normally not enabled on the server running the CC application. The timescaledb feature is installed as an optional package on the Control Center. When the timescaledb container is started, this causes side-effects by bypassing the existing firewall rules and limitations for Test Agent communications. Note: This issue only affects customers hosting their own on-prem Control Center. The Paragon Active Assurance Software as a Service (SaaS) is not affected by this vulnerability since the timescaledb service is not enabled. This issue affects all on-prem versions of Juniper Networks Paragon Active Assurance prior to 4.1.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通信信道对预期端点的不适当限制
Source: CVE Program / CVE List V5
Vulnerability Title
Juniper Networks Paragon Active Assurance 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Juniper Networks Paragon Active Assurance是美国瞻博网络（Juniper Networks）公司的一种可编程的测试和服务保证解决方案。使用基于软件和流量生成的测试代理，可作为 SaaS 解决方案从云中轻松使用和交付，或在 NFV 环境中本地部署。 Juniper Networks Paragon Active Assurance 4.1.2之前版本存在安全漏洞，该漏洞源于网络接口数据包处理异常情况时检查或处理不当，攻击者利用该漏洞可以向设备发送特定数据包导致内核崩溃
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Juniper Networks | Paragon Active Assurance | unspecified ~ 4.1.2 | - |
|
II. Public POCs for CVE-2023-28971
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28971
请登录查看更多情报信息。
Other References for CVE-2023-28971 (1)
Same Patch Batch · Juniper Networks · 2023-04-17 · 25 CVEs total
| CVE-2023-28983 | 8.8 HIGH | Junos OS Evolved: Shell Injection vulnerability in the gNOI server |
| CVE-2023-28960 | 8.2 HIGH | Junos OS Evolved: Docker repository is world-writeable, allowing low-privileged local user |
| CVE-2023-28966 | 7.8 HIGH | Junos OS Evolved: Local low-privileged user with shell access can execute CLI commands as |
| CVE-2023-28967 | 7.5 HIGH | Junos OS and Junos OS Evolved: An attacker sending genuine BGP packets causes an RPD crash |
| CVE-2023-28964 | 7.5 HIGH | Junos OS and Junos OS Evolved: Malformed BGP flowspec update causes RPD crash |
| CVE-2023-28982 | 7.5 HIGH | Junos OS and Junos OS Evolved: In a BGP rib sharding scenario when a route is frequently u |
| CVE-2023-28976 | 7.5 HIGH | Junos OS: MX Series: If a specific traffic rate goes above the DDoS threshold it will lead |
| CVE-2023-28974 | 7.4 HIGH | Junos OS: MX Series: In a BBE scenario upon receipt of specific malformed packets from sub |
| CVE-2023-28973 | 7.1 HIGH | Junos OS Evolved: The 'sysmanctl' shell command allows a local user to gain access to some |
| CVE-2023-28972 | 6.8 MEDIUM | Junos OS: NFX Series: 'set system ports console insecure' allows root password recovery |
| CVE-2023-28970 | 6.5 MEDIUM | Junos OS: JRR200: Kernel crash upon receipt of a specific packet |
| CVE-2023-28965 | 6.5 MEDIUM | Junos OS: QFX10002: Failure of storm control feature may lead to Denial of Service |
| CVE-2023-28981 | 6.5 MEDIUM | Junos OS and Junos OS Evolved: If malformed IPv6 router advertisements are received, memor |
| CVE-2023-28959 | 6.5 MEDIUM | Junos OS: QFX10002: PFE wedges and restarts upon receipt of specific malformed packets |
| CVE-2023-1697 | 6.5 MEDIUM | Junos OS: QFX10000 Series, PTX1000 Series: The dcpfe process will crash when a malformed e |
| CVE-2023-28961 | 5.8 MEDIUM | Junos OS: ACX Series: IPv6 firewall filter is not installed in PFE when "from next-header |
| CVE-2023-28980 | 5.5 MEDIUM | Junos OS and Junos OS Evolved: In a BGP rib sharding scenario an rpd crash will happen sho |
| CVE-2023-28978 | 5.3 MEDIUM | Junos OS Evolved: Read access to some confidential user information is possible |
| CVE-2023-28962 | 5.3 MEDIUM | Junos OS: Unauthenticated access vulnerability in J-Web |
| CVE-2023-28963 | 5.3 MEDIUM | Junos OS: User-controlled input vulnerability in J-Web |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Paragon Active Assurance
-
CVE-2024-30381
Paragon Active Assurance: probe_serviced exposes internal ob -
CVE-2024-21589
Paragon Active Assurance Control Center: Information disclos -
CVE-2022-22190
Paragon Active Assurance Control Center: Information disclos -
CVE-2021-0232
Paragon Active Assurance: Authentication bypass vulnerabilit
Same vendor: Juniper Networks
-
CVE-2026-57054
Junos OS: MX Series: Web filtering doesn't block specificall -
CVE-2026-57032
Junos OS: EX Series: Subscribing to an unsupported telemetry -
CVE-2026-57031
Junos OS: MX Series: For subscribers configured on static in -
CVE-2026-57030
Junos OS: SRX Series: Flow sessions are not getting cleared -
CVE-2026-57029
Junos OS Evolved: QFX Series: When sFlow collector reachabil
V. Comments for CVE-2023-28971
No comments yet