Juniper slips out update after hardcoded credentials left in switches

Juniper Networks has issued an update after finding hardcoded credentials had been left in some of its datacenter switches. The exposed login, designated CVE-2019-0034, was found in the Junos Network Agent, a software tool used to manage sensors and other devices that monitor network performance. Specifically, hardcoded …

[tip pc]

Again

Again!!!!!!!

[Waseem Alkurdi]

Yes.

Yes.

[Anonymous Coward]

@tip pc - Re: Again

There are no laws against stupidity because they would be difficult to enforce.

[GnuTzu]

Re: Again

OOOOOOHHHHHHH MMMMMYYYYYY GGGGGAAAAAAWWWWWDDDDDDDDDDDDDDDD

[Yet Another Anonymous coward]

Backdoor found in foreign telecoms gear

Time for a ban.....

[rjed]

Get your act together, Juniper!

Gets me thinking, even with multi-level peer code reviews, automated static/dynamic code analysis, the hardcoded credentials still managed to sneak in to the production. The Junos version mentioned was last updated in Feb 2019. Pretty reprehensible!

[Tom Chiverton 1]

Re: Get your act together, Juniper!

Sneak ?

Maybe they were told to put them there...

[Rajesh Kanungo]

Re: Get your act together, Juniper!

Sometimes developers will mask the static code analysis results (mark it inapplicable or something) so it avoids the reviewer's inspection. Sometimes the code is just not analyzed. Sometimes the software is supposed to be just a 'tool' and not considered important. Sometimes developers don't understand what it means. Sometimes the managers override the engineers. Also, peer code reviews can get a bit chummy.

Pretty reprehensible.

Mostly, when you see one such mistake, look for more of the same.