DaystoPatch

Juniper NetworksExploited incident

Juniper ScreenOS unauthorized-code backdoor allowing administrative access (2015)

CVE-2015-7755, CVE-2015-7756Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 2 Oct 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Ars Technica (Dan Goodin)CuratedQuote verified

    “During a recent internal code review, Juniper discovered unauthorized code in ScreenOS that could allow a knowledgeable attacker to gain administrative access to NetScreen devices and to decrypt VPN connections,” Juniper Chief Information officer Bob Worrall wrote.

    Article dated 'Dec 17, 2015 6:50 pm' (time zone not shown). Juniper's own announcement was the first public signal; the backdoor code dated back to at least 2012.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a8f8707989c96936…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    Hacker NewsClaimedQuote not checked yet18 Dec 2015, 20:47 UTC

    interested, I have been working on diffing the code for the backdoored vs patched versions: https://github.com/hdm/juniper-cve-2015-7755

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2015-7755ClaimedQuote verified19 Dec 2015, 11:00 UTC

    Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0bab97d66025907d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet29 Jan 2025, 16:07 UTC

    Alerte n°2015-ALE-014 du CERT-Fr au sujet de la vulnérabilité dans Juniper ScreenOS (CVE-2015-7755) ... >>

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2015-7755)ClaimedQuote verified2 Oct 2025

    Juniper ScreenOS Improper Authentication Vulnerability

    Added to CISA's KEV catalog on 2025-10-02.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    CERT/CC Vulnerability Note VU#640184CuratedQuote verified

    Date Public: 2015-12-17

    Juniper's out-of-cycle bulletin JSA10713 and forum post 'Important Announcement about ScreenOS' are no longer reachable (the KB is JavaScript-only and forums.juniper.net no longer resolves); CERT/CC records the public date.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:09552f5beb386a5f…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Ars Technica (quoting Juniper CIO Bob Worrall)CuratedQuote verified

    worked to develop and issue patched releases for the latest versions of ScreenOS.

    Patched releases (6.2.0r19, 6.3.0r12b-6.3.0r20b, 6.3.0r21) were released with the 2015-12-17 announcement. Upper bound: fixed builds may have shipped earlier; only the date shown here is evidenced (R2).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:a8f8707989c96936…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    CERT/CC Vulnerability Note VU#640184CuratedQuote verified

    Juniper has issued guidance to install the patched versions of ScreenOS.

    Fixes were issued for every affected ScreenOS 6.2.0/6.3.0 release line at once (per the CVE record's affected-version list).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:09552f5beb386a5f…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • ScreenOS (NetScreen firewalls)
How we built this timeline

Old incident included because CISA added CVE-2015-7755 to KEV on 2 Oct 2025. CVE-2015-7756 (VPN decryption via the Dual_EC backdoor) was fixed in the same bulletin and is grouped here.

Previously null: the unauthorized code existed from 2012 and its use before disclosure is unknown; the admin backdoor password became public around 20 Dec 2015 (Rapid7/HD Moore) and exploitation attempts were reported afterwards. CVSS 9.8 is NVD's v3 score for CVE-2015-7755 (no vendor v3 score).

The CVE record was published by MITRE on 19 Dec 2015, after Juniper's disclosure. ScreenOS is long end of life; patched releases existed for the lines supported in 2015.

R4 (23 Oct 2026): exploited before a fix changed from null to false. Patched releases were public on 17 Dec 2015, before any public evidence of exploitation (attempts were reported after the password became public around 20 Dec 2015); earlier use of the unauthorized code is unknown, not evidenced.

T2 search (23 Oct 2026) before keeping exploited before a fix=false: Anomali reported honeypot attempts using the backdoor password from 22 Dec 2015, after Rapid7 published it; SANS ISC and Security Affairs (23 Dec 2015) likewise report only post-disclosure attempts;

Rapid7 dates the backdoor code to late 2013 but gives no evidence of use. No post-mortem shows exploitation before the 17 Dec 2015 fix, so the value stays false.

Related

No related incidents.

Juniper Networks report card