Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
juniper-cve-2015-7755 — Notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS | Kitploit
Tools/GitHubGitHub/hdm/juniper-cve-2015-7755
Vulnerability AnalysisExploitationReverse EngineeringCryptographyBinary AnalysisFirmware Analysis
GitHubhdm/juniper-cve-2015-7755

juniper-cve-2015-7755

Notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS

View Repository
105355 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Juniper CVE-2015-7755 & CVE-2015-7756

This repository contains notes, binaries, and related information from analysis of the CVE-2015-7755 & CVE-2015-7756 issues within Juniper ScreenOS.

For more information about these issues, please see the URLs below:

  • https://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554
  • https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10713&cat=SIRT_1&actp=LIST&smlogin=true

Findings

  • CVE-2015-7755: This password has been identified as <<< %s(un='%s') = %u. Please see this blog post for more information.
  • CVE-2015-7765: The Dual_EC_DRBG 'Q' parameter was replaced with 9585320EEAF81044F20D55030A035B11BECE81C785E6C933E4A8A131F6578107 and the secondary ANSI X.9.31 PRNG was broken, allowing raw Dual_EC output to be exposed to the network. Please see this blog post for more information.

6.2.0 Firmware

  • ssg500.6.2.0r14.0.bin: This is the last stable 6.2.0 release before the backdoors were introduced.
  • ssg500.6.2.0r15.0.bin: This is the first stable 6.2.0 release containing the backdoor. Not affected by CVE-2015-7755.
  • ssg500.6.2.0r16.0.bin: Not affected by CVE-2015-7755.
  • ssg5ssg20.6.2.0r18.0.bin: Not affected by CVE-2015-7755.

6.3.0 Firmware

  • ssg500.6.3.0r12.0.bin: This is the first stable 6.3.0 release with the backdoor introduced. Not affected by CVE-2015-7755.
  • ssg500.6.3.0r12b.0.bin: This is the rebuilt 6.3.0r12 release with the backdoor removed.
  • ssg5ssg20.6.3.0r14.0.bin: Not affected by CVE-2015-7755.
  • ssg5ssg20.6.3.0r17.0.bin: Confirmed CVE-2015-7755.
  • ssg5ssg20.6.3.0r18.0.bin: Confirmed CVE-2015-7755.
  • ssg5ssg20.6.3.0r19.0.bin: Confirmed CVE-2015-7755.
  • ssg5ssg20.6.3.0r19b.0.bin: Rebuilt version with the backdoors removed.

Unpacking

The firmware files in this repository were extracted from the Juniper software distributon using binwalk -e. The resulting files contains the raw x86 firmware, which can loaded into tools like IDA Pro. Data references in IDA Pro are incorrect due to some of section padding or alignment that occurs when the firmware is loaded into memory.

Download Tool