CVE-2015-7755: Juniper ScreenOS Unauthorized Backdoor Authentication Bypass (KEV)

CVE-2015-7755 is an authentication-bypass vulnerability caused by unauthorized code planted inside Juniper ScreenOS firmware: a specific hardcoded password, when entered at an SSH or Telnet login prompt, grants full administrative access regardless of the real credentials, and public reverse-engineering confirmed the exact backdoor string and the firmware builds that contained it.

CVE-2015-7755 (CWE-287, Improper Authentication) affects Juniper Networks' ScreenOS firewall operating system. NVD's description states that ScreenOS "6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 allows remote attackers to obtain administrative access by entering an unspecified password during a (1) SSH or (2) TELNET session" (NVD).

NVD's own analysis gives it a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (also scored the maximum 10.0 under the legacy CVSS v2 Primary metric) — network-reachable, low attack complexity, no privileges or user interaction required, full confidentiality/integrity/availability impact (NVD).

Public firmware reverse-engineering, published by security researcher HD Moore shortly after Juniper's original disclosure, identified the literal backdoor credential as the string <<< %s(un='%s') = %u entered in place of a password at the SSH or Telnet admin prompt, and confirmed that ScreenOS 6.2.0r15.0 was "the first stable 6.2.0 release containing the backdoor," with the 6.3.0r12 branch introducing it there too; Juniper's rebuilt "b" releases (for example 6.3.0r19b.0) had the unauthorized code removed. The same unauthorized code change was also tied to CVE-2015-7756, a separate, compounding weakness in ScreenOS's VPN random-number generation (a manipulated Dual_EC_DRBG parameter) that could let an attacker who recorded encrypted VPN traffic later decrypt it (HD Moore: juniper-cve-2015-7755 firmware analysis).

Juniper's own out-of-cycle security bulletin, published 2015-12-17, disclosed that an internal code review had found "unauthorized code" in ScreenOS that could allow an attacker to gain administrative access and separately to decrypt VPN traffic, and directed customers to install the patched "b" builds (or 6.3.0r21) immediately; this is recorded in CISA's KEV notes as the primary vendor advisory for this CVE (CISA KEV).

CISA added CVE-2015-7755 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-10-02 — a decade after original disclosure — with a required-action due date of 2025-10-23, confirming the flaw is still being tracked as exploited in current attacks against any ScreenOS devices that remain unpatched or in extended use (CISA KEV; confirmed present in the live KEV feed by exact cveID match this run).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.61139 (99.158th percentile) — extremely high for a ten-year-old CVE, consistent with a trivially exploitable, unauthenticated full-admin backdoor that remains scanned for wherever legacy ScreenOS devices are still reachable (FIRST EPSS).

Any Juniper ScreenOS device still running an affected 6.2.0r15-r18 or 6.3.0r12-r20 (pre-"b") build should be upgraded immediately — ScreenOS itself has been end-of-life for years, so replacement with a supported platform, not just a patch, is the realistic remediation path.

• Unauthorized code in ScreenOS 6.2.0r15-r18 and 6.3.0r12-r20 (pre-"b" builds) allows remote attackers to obtain full administrative access by entering a specific password during an SSH or Telnet session. — NVD
• CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD Primary); also scored 10.0 under legacy CVSS v2. — NVD
• The exact backdoor credential is the string "<<< %s(un='%s') = %u"; ScreenOS 6.2.0r15.0 was the first stable release with the backdoor, 6.3.0r12 introduced it to that branch, and Juniper's rebuilt "b" releases removed it; a related weakness (CVE-2015-7756) compromised VPN traffic decryption via a manipulated Dual_EC_DRBG parameter. — HD Moore: juniper-cve-2015-7755 firmware analysis
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-10-02, required-action due date 2025-10-23; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
• EPSS score is 0.61139 (99.158th percentile) as of 2026-10-29. — FIRST EPSS