■■□□□ Possible zero-day in Juniper product.
On Wednesday, SANS Institute’s Johannes Ullrich said he noticed a surge in scans for the username “t128,” which, when accompanied by the password “128tRoutes,” is a well-known default account for Juniper’s Session Smart Networking products.
“About 3,000 source IPs took part in these scans,” reported Ullrich, the dean of research at the infosec education and training outfit.
https://isc.sans.edu/diary/Surge+in+Scans+for+Juniper+t128+Default+User/31824
https://www.theregister.com/2025/04/03/unknown_scanners_probing_juniper_paloalto/