STIGQter: STIG Summary: Juniper EX Series Switches Network Device Management Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to only store cryptographic representations of passwords.

DISA Rule

SV-253910r1018768_rule

Vulnerability Number

V-253910

Group Title

SRG-APP-000171-NDM-000258

Rule Version

JUEX-NM-000330

Severity

CAT I

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

Weight

10

Fix Recommendation

Configure the network device, and any associated authentication servers, to store all passwords using cryptographic representations.

set system login password format <sha-256|sha-512>
Note: Although Junos supports the SHA-1 hashing algorithm, it is included only for backwards compatibility when restoring a previous configuration from an older version.

Configure all associated databases, configuration files, and log files to use only encrypted representations of passwords, and that no password strings are readable/discernable.

Potential locations include the local file system where configurations and events are stored, or in a network device-related database table.

Check Contents

Review the network device’s files using a text editor or a database tool that allows viewing data stored in database tables. Determine if password strings are readable/discernable.

Determine if the network device, and any associated authentication servers, enforce only storing cryptographic representations of passwords. Verify that databases, configuration files, and log files have encrypted representations of all passwords, and that no password strings are readable/discernable. Potential locations include the local file system where configurations and events are stored, or in a network device related database table. Also identify if the network device uses the MD5 hashing algorithm to create password hashes.

By default, Junos uses SHA-512 as the password hashing algorithm to save only hashed representations of passwords. Verify the hashing algorithm at [edit system login password] format.

[edit system login password]
:
format sha512;

If the network device, or any associated authentication servers, stores unencrypted (clear text) representations of passwords, this is a finding.

If the network device uses MD5 hashing algorithm to create password hashes, this is a finding.

Vulnerability Number

V-253910

Documentable

False

Rule Version

JUEX-NM-000330

Severity Override Guidance

Review the network device’s files using a text editor or a database tool that allows viewing data stored in database tables. Determine if password strings are readable/discernable.

Determine if the network device, and any associated authentication servers, enforce only storing cryptographic representations of passwords. Verify that databases, configuration files, and log files have encrypted representations of all passwords, and that no password strings are readable/discernable. Potential locations include the local file system where configurations and events are stored, or in a network device related database table. Also identify if the network device uses the MD5 hashing algorithm to create password hashes.

By default, Junos uses SHA-512 as the password hashing algorithm to save only hashed representations of passwords. Verify the hashing algorithm at [edit system login password] format.

[edit system login password]
:
format sha512;

If the network device, or any associated authentication servers, stores unencrypted (clear text) representations of passwords, this is a finding.

If the network device uses MD5 hashing algorithm to create password hashes, this is a finding.

Check Content Reference

M

Target Key

5477