Description
An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.
A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.
This issue affects Junos OS:
* 24.4 versions before 24.4R2-S4;
* 25.2 versions before 25.2R2-S1;
* 25.4 versions before 25.4R1-S3;
This issue does not affect Junos OS releases before 24.4R1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Juniper Networks | Junos OS | 24.4 – < 24.4R2-S4, 25.2 – < 25.2R2-S1, 25.4 – < 25.4R1-S3 | 24.4R2-S4 |
References
- https://supportportal.juniper.net/JSA112180 vendor-advisory