CVE-2015-7755
CVE-2015-7755 is a security flaw in Juniper ScreenOS, the operating system on Juniper’s routers and firewalls. Attackers can get into Juniper ScreenOS without a valid password. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of flaws known to be used in attacks on 2 Oct 2025.[1]
Juniper ScreenOS is business software or equipment. Most families won’t have it, but attackers break into it to get inside companies, and from there to what those companies hold about their customers, patients and staff. Juniper has published a fix or advice.
Description
CISA calls it an improper authentication in Juniper ScreenOS. In its words: “Juniper ScreenOS contains an improper authentication vulnerability that could allow unauthorized remote administrative access to the device.”[1]
The CVE record adds: “Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session.”[2]
The underlying weakness is improper authentication (CWE-287), in MITRE’s list of common software weaknesses.
It scores 9.8 out of 10 on the Common Vulnerability Scoring System, which rates it critical, scored by NVD using CVSS 3.1.[2]
Affected versions
NVD’s record doesn’t list version ranges for it; Juniper’s advisory has them[3]. CISA names the product as Juniper ScreenOS.
Most families won’t have Juniper ScreenOS; it’s for whoever looks after IT at work.
Exploitation
CISA added it to its catalog of known exploited vulnerabilities on 2 Oct 2025, 3,575 days after it was made public. CISA lists a flaw only when it has reliable evidence of it being exploited, and gave US federal agencies until 23 Oct 2025 to fix it.[1]
FIRST’s Exploit Prediction Scoring System, which estimates how likely a flaw is to be used in attacks in the next 30 days from what it sees across the internet, puts it at 61%. That’s in the top 1% of the flaws it scores.[4]
CISA assesses it as automatable: attackers can run it against many targets at once.
CISA doesn’t say who was attacked, or how.
Fix
Juniper has published a fix or advice.[3] CISA’s required action: “Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.”[1]
- Check whether you use it.Juniper ScreenOS is business software or equipment, so most families won’t have it. If you run a business, or work from home on company equipment, ask whoever looks after your IT.
- Send this page to your IT person.Ask them to confirm it’s fixed, or not in use. CISA gave US government agencies until 23 Oct 2025 to fix it.
- If it can’t be fixed, take it offline.CISA’s advice when there’s no fix is to stop using the product, or take it off the internet, until there is one.
You can’t fix someone else’s server, but you can watch for what follows a break-in like this: a breach notice, a password reset you didn’t ask for, or a scam message that knows things it shouldn’t. HARD watches for those for you and your family.
Timeline
| Date | Event |
|---|---|
| The flaw is made public in the National Vulnerability Database, with a severity score of 9.8.[2] | |
| CISA adds it to its catalog of flaws known to be used in attacks.[1] | |
| CISA’s deadline for US government agencies to fix it.[1] | |
| FIRST puts the odds of it being used in attacks in the next 30 days at 61%.[4] |
See also
Other Juniper flaws
- CVE-2025-21590, Juniper Junos OS: improper isolation or compartmentalization ·
- CVE-2023-36851, Juniper Junos OS: SRX series missing authentication for critical function ·
- CVE-2023-36847, Juniper Junos OS: EX series missing authentication for critical function ·
- CVE-2023-36846, Juniper Junos OS: SRX series missing authentication for critical function ·
- CVE-2023-36845, Juniper Junos OS: EX series and SRX series PHP external variable modification ·
Other improper authentication flaws
- CVE-2026-105133, AhsayCBS: improper authentication ·
- CVE-2026-42018, JFrog Artifactory: improper authentication ·
- CVE-2026-82329, JFrog Artifactory: improper authentication ·
- CVE-2026-59822, BerriAI LiteLLM: improper authentication ·
- CVE-2023-49105, ownCloud: improper authentication ·
Added the same day
- CVE-2025-4008, Smartbedded Meteobridge: command injection ·
- CVE-2025-21043, Samsung Mobile Devices: out-of-bounds write ·
- CVE-2017-1000353, Jenkins: remote code execution ·
- CVE-2014-6278, GNU Bash: bash OS command injection ·
Every Juniper flaw on CISA’s list · Everything added in October 2025
References
- ^ Cybersecurity and Infrastructure Security Agency. “Juniper ScreenOS Improper Authentication Vulnerability”. Known Exploited Vulnerabilities Catalog, added 2 Oct 2025.
- ^ National Institute of Standards and Technology. “CVE-2015-7755 Detail”. National Vulnerability Database, published 19 Dec 2015.
- ^ Juniper. Advisories and fixes: supportportal.juniper.net, forums.juniper.net.
- ^ FIRST. “Exploit Prediction Scoring System”. EPSS 0.611, percentile 99.2, 31 Oct 2026.
- CVE Program. “CVE-2015-7755”. The official CVE record.
This article is built from CISA’s catalog (version 2026.10.30), NVD’s record and FIRST’s scores, kept in HARD’s database and checked every morning. The plain English is HARD’s.