CVE-2024-30381

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-30381
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices. The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc. The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center. This issue affects Paragon Active Assurance: 4.1.0, 4.2.0.

8.4 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://supportportal.juniper.net/JSA79173 Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H Vendor Advisory
https://supportportal.juniper.net/JSA79173 Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:juniper:paragon_active_assurance_control_center:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:juniper:paragon_active_assurance_control_center:4.2.0:*:*:*:*:*:*:*
History

16 Jan 2026, 19:49

Type Values Removed Values Added
References () https://supportportal.juniper.net/JSA79173 - () https://supportportal.juniper.net/JSA79173 - Vendor Advisory
References () https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H - () https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H - Vendor Advisory
CPE cpe:2.3:a:juniper:paragon_active_assurance_control_center:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:juniper:paragon_active_assurance_control_center:4.2.0:*:*:*:*:*:*:*
First Time Juniper paragon Active Assurance Control Center
Juniper

21 Nov 2024, 09:11

Type Values Removed Values Added
References () https://supportportal.juniper.net/JSA79173 - () https://supportportal.juniper.net/JSA79173 -
References () https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H - () https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H -

16 May 2024, 18:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 10.0 		v2 : unknown
v3 : 8.4
Summary (en) An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices. The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc. The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center. This issue affects Paragon Active Assurance: 4.1.0, 4.2.0. (en) An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices. The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc. The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center. This issue affects Paragon Active Assurance: 4.1.0, 4.2.0.

16 May 2024, 17:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.4 		v2 : unknown
v3 : 10.0

12 Apr 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-12 15:15

Updated : 2026-01-16 19:49

NVD link : CVE-2024-30381

Mitre link : CVE-2024-30381

CVE.ORG link : CVE-2024-30381

JSON object : View

Products Affected

juniper

  • paragon_active_assurance_control_center
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor