CVE-2026-102079: Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection
An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device.
A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification.
This issue affects Junos OS:
24.4 versions before 24.4R2-S4; 25.2 versions before 25.2R2-S1; 25.4 versions before 25.4R1-S3;
This issue does not affect Junos OS releases before 24.4R1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 24.4R2-S4 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 25.2R2-S1 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 25.4R1-S3 - Upgrade
Upgrade
Juniper Networks Junos OSto a version that resolves this vulnerability.Fixed in 26.2R1
Event History
Frequently Asked Questions
Which systems are affected?
The issue affects Junos OS 24.4 releases before 24.4R2-S4, 25.2 releases before 25.2R2-S1, and 25.4 releases before 25.4R1-S3. Releases before 24.4R1 are not affected.
What level of access does an attacker need?
An attacker needs local access and low privileges on the device. No user interaction is required.
What can successful exploitation allow?
The vulnerable request csds CLI command can process attacker-controlled input as an OS command. This can result in command execution with root privileges and complete device compromise, including unauthorized access or modification.
Which fixed releases should be used for remediation?
Upgrade affected 24.4 deployments to 24.4R2-S4 or later, 25.2 deployments to 25.2R2-S1 or later, and 25.4 deployments to 25.4R1-S3 or later.