Searching for the text "strcmp" finds a static string that is referenced in the sub_ED7D94 function. Looking at the strings output, we can see some interesting string references, including auth_admin_ssh_special and auth_admin_internal. Searching for auth_admin_internal finds the sub_13DBEC function. This function has a strcmp call that is not present in the 6.3.0r19b firmware:

  The argument to the strcmp call is <<< %s(un='%s') = %u, which is the backdoor password, and was presumably chosen so that it would be mistaken for one of the many other debug format strings in the code. This password allows an attacker to bypass authentication through SSH and Telnet.

[1] is the backdoor. [2] is more details regarding discovery.

[1] https://github.com/rapid7/metasploit-framework/blob/master/m...

[2] https://blog.rapid7.com/2015/12/20/cve-2015-7755-juniper-scr...