A NULL Pointer Dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker setting or deactivating a specific SSH configuration parameter to create a Denial of Service (DoS).

A local high-privileged user configuring or deactivating a specific 'system services ssh' configuration parameter can exploit a null pointer dereference in one of the functions used by SSH. The function attempts to dereference a null pointer when accessing certain configuration data, resulting in an mgd process crash and restart. Continued execution of these configuration commands will create a sustained Denial of Service (DoS) condition.

This issue affects: Junos OS:

from 22.3 before 22.3R3-S5; from 22.4 before 22.4R3-S10; from 23.2 before 23.2R2-S7; from 23.4 before 23.4R2-S8.

This issue does not affect Junos OS before 22.3R1.

Junos OS Evolved: from 22.3R1-EVO before 23.2R2-S7-EVO; from 23.4 before 23.4R2-S8-EVO.

This issue does not affect Junos OS Evolved before 22.3R1-EVO.

An Unchecked Input for Loop Condition vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).Micro-BFD session flaps generate respective up/down events which are queued by PFEMAN for processing. Especially in a Virtual-Chassis (VC) scenario with locality‑bias configured, processing takes a significant amount of time for each event. If these sessions keep flapping, new events are constantly added, and in turn PFEMAN never completes processing these events. This results in the PFEMAN watchdog timer expiring, which causes the FPC to crash and restart, representing a complete service outage.

This issue only affects MX series FPCs up to and including MPC9, and LC2101/2103 and LC480. It does not affect MPC10/11, LC4800/9600, and MX304.

This issue affects Junos OS on MX Series:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S3, 25.2 versions before 25.2R2.

A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain access to Linux-based line cards as root.

This issue affects systems running Junos OS using Linux-based line cards. Affected line cards include: MPC7, MPC8, MPC9, MPC10, MPC11 LC2101, LC2103 LC480, LC4800, LC9600 MX304 (built-in FPC) MX-SPC3 SRX5K-SPC3 EX9200-40XS

FPC3-PTX-U2, FPC3-PTX-U3 FPC3-SFF-PTX LC1101, LC1102, LC1104, LC1105

This issue affects Junos OS:

all versions before 22.4R3-S8,  from 23.2 before 23.2R2-S6,  from 23.4 before 23.4R2-S6,  from 24.2 before 24.2R2-S3,  from 24.4 before 24.4R2, from 25.2 before 25.2R2.

A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS).

On EX Series, QFX Series and MX Series a low-privileged attacker issuing a specific 'show l2-learning' or 'show ethernet-switching' command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted.

This issue affects EX Series, QFX Series, MX Series: Junos OS:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S7, 24.2 versions before 24.2R2, 24.4 versions before 24.4R1-S2.

Junos OS Evolved: all versions before 23.2R2-S7-EVO, 23.4 versions before 23.4R2-S8-EVO, 24.2 versions before 24.2R2-EVO, 24.4 versions before 24.4R1-S3-EVO.

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a local, authenticated attacker to cause a Denial-of-Service (DoS).

On EX2300, EX4000, EX4100, EX4300-MP (Multigigabit) and EX4400 switches, an authenticated, local attacker with no specific permissions or class can execute a specific, privileged CLI 'request' command which will cause complete traffic impact until the system automatically recovers.

This issue affects Junos OS on EX2300, EX4000, EX4100, EX4300-MP (Multigigabit) and EX4400:

23.2R2 versions before 23.2R2-S6, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S3, 25.2 versions before 25.2R2, 25.4 versions before 25.4R1-S1.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When an affected device initiates a TCP connection to an attacker-controlled system that responds with a specific packet, this causes a PFE crash and restart, which affects all services until the system has automatically recovered. This issue can happen among others in the following scenarios: ALG, SSL proxy, UTM, RTLOG, AppQoE probing, AAMW, ICAP, URL filtering.

This issue affects Junos OS on MX Series with SPC3, SRX5k Series with SPC3, SRX1600 Series, SRX2300 Series, SRX4000 Series, and vSRX Series:

all versions before 23.2R2-S4, 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2.

An Improper Validation of Specified Quantity in Input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS).

When TCP proxy is engaged in a flow session, to support ALGs, Advanced Anti-Malware, ICAP or UTM, a TCP packet with specifically malformed TCP header will cause flow processing daemon (flowd) to crash and restart. This causes a complete service outage until the system has automatically recovered.

This issue affects Junos OS on MX with SPC3, and SRX Series:

23.4 versions before 23.4R2-S7,  24.2 versions before 24.2R2-S4,  24.4 versions before 24.4R2-S3, 25.2 versions before 25.2R2.

This issue does not affect releases before 23.4R1.

A Use of Multiple Resources with Duplicate Identifier vulnerability in the IKE daemon (iked) of Juniper Networks Junos OS on MX with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

On an MX with SPC3 and SRX devices configured for VPN service, when a large number of VPN negotiations fail a peer index rollover will eventually occur. As a result, new peers are assigned index values that are already in use and the iked process starts to crash repeatedly. This results in failure to establish new VPN connections and rekeying existing ones. To restore service the system must be rebooted. Please note that the index value can't be monitored, so customers should monitor tunnel up and down events and if a lot of events occur over an extended period of time it becomes likely that this issue occurs.

To be exposed to this issue the system needs to run iked (vs. kmd which is not affected), which can be verified with:

user@host> show system processes extensive | match "KMD|IKED" This issue affects Junos OS on MX with SPC3, SRX Series:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S3, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R1-S1.

An Improper Validation of Syntactic Correctness of Input vulnerability in the SIP plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).If the SIP ALG is enabled on an affected device, the processing of a malformed SIP invite packet will cause a flow processing daemon (flowd) crash and restart. This leads to a complete service outage until the system has automatically recovered.

This issue affects Junos OS on MX Series with SPC3 and SRX Series:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S5, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2, 25.4 versions before 25.4R1-S2.

An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

When a specific packet is received from device in the same broadcast domain, an affected system calculates the packet size incorrectly. This causes further packet processing to fail, which triggers an FPC major error, resulting in a FPC reset impacting traffic until the FPC has automatically recovered.

Affected scenarios are: MAP-T, or non-IP traffic encapsulated in IP (e.g. MPLS over GRE).

When this issue happens the following logs can be observed:

fpc<#> CMError: /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSSCMERRORLIINTREGUNROLLTAILLENGTHOVF (0x2205eb), scope: pfe, category: functional, severity: major, module: MQSS(0), type: LI: Unroll TAIL length overflow, occategory: default fpc<#> Performing action reset-fru for error /fpc/0/pfe/0/cm/0/MQSS(0)/0/MQSSCMERRORLIINTREGUNROLLTAILLENGTHOVF (0x2205eb) in module: MQSS(0) with scope: pfe category: functional level: major, occategory: default

This issue affects Junos OS on MX Series:

all versions before 23.2R2-S6, 23.4 versions before 23.4R2-S7, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on QFX10000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).

On all QFX10000 platforms in an EVPN-VxLAN scenario, if an attacker sends IPv6 multicast traffic and these packets reach the non-IRB interface of a spine switch it floods the packet to other spines and all Ethernet Segment Identifier (ESI) leaf switches. This flooding causes the packet to be forwarded in a endless loop, which can lead to saturation of the involved links and in turn impact to legitimate traffic.

This issue affects Junos OS on QFX10000 Series:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S4.

This issue does not affect Junos version after 24.4 as the QFX10000 Series devices are not supported on newer versions anymore.

An Out-of-bounds Write vulnerability in the http-gatekeeper (http-gk) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

If an SRX Series device is configured for remote-access VPN with pre-logon compliance check, a network-based attacker sending specifically formatted requests can trigger an out of bounds write leading to an http-gk process crash. This crash leads to unavailability of all services depending on the [ system services web-management ] configuration (like J-Web, remote access VPN and firewall authentication) until the process automatically restarts.

This issue affects Junos OS on SRX Series:

23.2 versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2, 25.4 versions before 25.4R1-S1, 25.4R2.

A Missing Release of Memory after Effective Lifetime vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series devices allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).When sFlow is configured in a Virtual Chassis (VC) scenario with EX4100 Series or EX4400 Series devices, multicast traffic which is received on one VC member and sent out on another member leads to a memory leak and ultimately an FPC crash and restart.

The leak can be monitored by watching the continuous increase of the buffer values in the output of:

user@host> show chassis fpc This issue affects Junos OS on EX4100 Series and EX4400:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S7, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2.

An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on EX Series devices allows an authenticated attacker with low privileges to cause a Denial-of-Service (DoS).

If an attempt is made to subscribe to an unsupported telemetry sensor path on EX2300, EX3400, EX4000, EX4100 and EX4400 via gRPC, this causes the FPC to crash. This leads to a complete service outage until the module has automatically restarted.

The following log message can be seen when this issue happens:

agentd[<PID>]: AGENTDRESOURCENOTFOUND: No resource name found for <sensor>

This issue affects Junos OS on

EX2300, EX3400, EX4000, EX4100 and EX4400

devices:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S5, 24.4 versions before 24.4R2.

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable.

If an MX Series device is configured with web filtering, and an attacker sends a request with a specifically formatted URL, this request will get forwarded despite the system being configured to block it. In turn, an attacker can access downstream resources that are expected to be unreachable.

This issue affects Junos OS on MX Series:

all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S8, 24.2 versions before 24.2R2-S5, 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2-S1, 25.4 versions before 25.4R1-S2, 25.4R2.

An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker sending specific valid SNMPv3 queries to trigger a memory leak. Over time, continuous receipt of these queries will result in snmpd process memory exhaustion, resulting in a process crash and restart, impacting the ability to monitor the system via SNMP.

Memory usage can be monitored using the following command:

user@device> show system processes extensive | match snmpd

This issue affects:

Junos OS:

all versions before 21.2R3-S8; from 21.4 before 21.4R3-S7; from 22.1 before 22.1R3-S6; from 22.2 before 22.2R3-S4; from 22.3 before 22.3R3-S3; from 22.4 before 22.4R3-S2; from 23.2 before 23.2R2; from 23.4 before 23.4R2.

Junos OS Evolved: all versions before 21.2R3-S8-EVO; from 21.4 before 21.4R3-S7-EVO; all versions of 22.1-EVO, from 22.2 before 22.2R3-S4-EVO; from 22.3 before 22.3R3-S3-EVO; all versions of 22.4-EVO, from 23.2 before 23.2R2-EVO; from 23.4 before 23.4R2-EVO.

An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the

Juniper Web Device Manager

(J-Web).

When Juniper Secure connect (JSC) is enabled on specific interfaces, or multiple interfaces are configured for J-Web, the J-Web UI is reachable over more than the intended interfaces. This issue affects Junos OS:

all versions before 21.4R3-S9, 22.2 versions before 22.2R3-S5, 22.4 versions before 22.4R3-S5, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2.

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.

A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS:

All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10,  22.2 versions before 22.2R3-S6,  22.4 versions before 22.4R3-S6,  23.2 versions before 23.2R2-S3,  23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R1-S2, 24.2R2.

An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system.

Certain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system. This issue affects:

Junos OS:

all versions before 22.4R3-S8,  from 23.2 before 23.2R2-S5,  from 23.4 before 23.4R2-S7,  from 24.2 before 24.2R2-S2,  from 24.4 before 24.4R2,  from 25.2 before 25.2R2;

Junos OS Evolved:

all versions before 22.4R3-S8-EVO,  from 23.2 before 23.2R2-S5-EVO,  from 23.4 before 23.4R2-S7-EVO,  from 24.2 before 24.2R2-S2-EVO,  from 24.4 before 24.4R2-EVO,  from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.

A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.

When after a user has performed a specific 'file link ...' CLI operation, another user commits (unrelated configuration changes), the first user can login as root.

This issue affects Junos OS: all versions before 23.2R2-S7, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S3, 24.4 versions before 24.4R2-S2, 25.2 versions before 25.2R2.

This issue does not affect versions 25.4R1 or later.

An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service (DoS) of the management plane.

When NETCONF sessions are quickly established and disconnected, a locking issue causes mgd processes to hang in an unusable state. When the maximum number of mgd processes has been reached, no new logins are possible. This leads to the inability to manage the device and requires a power-cycle to recover.

This issue can be monitored by checking for mgd processes in lockf state in the output of 'show system processes extensive':

user@host> show system processes extensive | match mgd <pid> root       20   0 501M 4640K lockf   1 0:01 0.00% mgd

If the system still can be accessed (either via the CLI or as root, which might still be possible as last resort as this won't invoke mgd), mgd processes in this state can be killed with 'request system process terminate <PID>' from the CLI or with 'kill -9 <PID>' from the shell.

This issue affects:

Junos OS:

23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2-S1, 24.4 versions before 24.4R1-S3, 24.4R2;

This issue does not affect Junos OS versions before 23.4R1;

Junos OS Evolved:

23.4 versions before 23.4R2-S5-EVO, 24.2 versions before 24.2R2-S1-EVO, 24.4 versions before 24.4R1-S3-EVO, 24.4R2-EVO.

This issue does not affect Junos OS Evolved versions before 23.4R1-EVO;

A Missing Release of Memory after Effective Lifetime vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to cause a memory leak ultimately leading to a Denial of Service (DoS).

In an EVPN-MPLS scenario, routes learned from remote multi-homed Provider Edge (PE) devices are programmed as ESI routes. Due to a logic issue in the l2ald memory management, memory allocated for these routes is not released when there is churn for these routes. As a result, memory leaks in the l2ald process which will ultimately lead to a crash and restart of l2ald.

Use the following command to monitor the memory consumption by l2ald:

user@device> show system process extensive | match "PID|l2ald"

This issue affects:

Junos OS:

all versions before 22.4R3-S5, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2;

Junos OS Evolved:

all versions before 22.4R3-S5-EVO, 23.2 versions before 23.2R2-S3-EVO, 23.4 versions before 23.4R2-S4-EVO, 24.2 versions before 24.2R2-EVO.

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS).

If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory

available to bbe-smgd has been consumed, no new subscribers will be able to login.

The memory utilization of bbe-smgd can be monitored with the following show command:

user@host> show system processes extensive | match bbe-smgd

The below log message can be observed when this limit has been reached:

bbesmgd[<PID>]: %DAEMON-3-SMDDPROFRSMONERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion

This issue affects Junos OS on MX Series: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2, 25.2 versions before 25.2R2.

A Missing Release of Memory after Effective Lifetime vulnerability in the DHCP daemon (jdhcpd) of Juniper Networks Junos OS on MX Series, allows an adjacent, unauthenticated attacker to cause a memory leak, that will eventually cause a complete Denial-of-Service (DoS).

In a DHCPv6 over PPPoE, or DHCPv6 over VLAN with Active lease query or Bulk lease query scenario, every subscriber logout will leak a small amount of memory. When all available memory has been exhausted, jdhcpd will crash and restart which causes a complete service impact until the process has recovered.

The memory usage of jdhcpd can be monitored with:

user@host> show system processes extensive | match jdhcpd

This issue affects Junos OS:

all versions before 22.4R3-S1, 23.2 versions before 23.2R2, 23.4 versions before 23.4R2.

An Improper Validation of Syntactic Correctness of Input vulnerability in the IPsec library used by kmd and iked of Juniper Networks Junos OS on SRX Series and MX Series allows an unauthenticated, network-based attacker to cause a complete Denial-of-Service (DoS).

If an affected device receives a specifically malformed first ISAKMP packet from the initiator, the kmd/iked process will crash and restart, which momentarily prevents new security associations (SAs) for from being established. Repeated exploitation of this vulnerability causes a complete inability to establish new VPN connections.

This issue affects Junos OS on

SRX Series and MX Series:

all versions before 22.4R3-S9, 23.2 version before 23.2R2-S6, 23.4 version before 23.4R2-S7, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S3, 25.2 versions before 25.2R1-S2, 25.2R2.

An Improper Following of a Certificate's Chain of Trust vulnerability in J-Web of Juniper Networks Junos OS on SRX Series allows a PITM to intercept the communication of the device and get access to confidential information and potentially modify it.

When an SRX device is provisioned to connect to Security Director (SD) cloud, it doesn't perform sufficient verification of the received server certificate. This allows a PITM to intercept the communication between the SRX and SD cloud and access credentials and other sensitive information.

This issue affects Junos OS: all versions before 22.4R3-S9, 23.2 versions before 23.2R2-S6, 23.4 versions before 23.4R2-S7, 24.2 versions before 24.2R2-S3, 24.4 versions before 24.4R2-S2, 25.2 versions before 25.2R1-S2, 25.2R2.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1500, SRX4100, SRX4200 and SRX4600 allows a local attacker with low privileges to cause a complete Denial of Service (DoS).

When a specific 'show chassis' CLI command is executed, chassisd crashes and restarts which causes a momentary impact to all traffic until all modules are online again.

This issue affects Junos OS on SRX1500, SRX4100, SRX4200 and SRX4600:

23.2 versions before 23.2R2-S6, 23.4 versions before 23.4R2-S7 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2, 25.2 versions before 25.2R1-S1, 25.2R2.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an attacker sending a specific, malformed ICMPv6 packet to cause the srxpfe process to crash and restart. Continued receipt and processing of these packets will repeatedly crash the srxpfe process and sustain the Denial of Service (DoS) condition.

During NAT64 translation, receipt of a specific, malformed ICMPv6 packet destined to the device will cause the srxpfe process to crash and restart.

This issue cannot be triggered using IPv4 nor other IPv6 traffic.

This issue affects Junos OS on SRX Series: all versions before 21.2R3-S10, all versions of 21.3, from 21.4 before 21.4R3-S12, all versions of 22.1, from 22.2 before 22.2R3-S8, all versions of 22.4, from 22.4 before 22.4R3-S9, from 23.2 before 23.2R2-S6, from 23.4 before 23.4R2-S7, from 24.2 before 24.2R2-S3, from 24.4 before 24.4R2-S3, from 25.2 before 25.2R1-S2, 25.2R2.

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.

A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.

This issue affects

Junos OS: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S6, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S1, 25.2 version before 25.2R1-S2, 25.2R2;

Junos OS Evolved: all versions before 23.2R2-S6-EVO, 23.4 version before 23.4R2-S6-EVO, 24.2 version before 24.2R2-S4-EVO, 24.4 versions before 24.4R2-S1-EVO, 25.2 versions before 25.2R2-EVO.

An Execution with Unnecessary Privileges vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to gain root privileges, thus compromising the system.

When a configuration that allows unsigned Python op scripts is present on the device, a non-root user is able to execute malicious op scripts as a root-equivalent user, leading to privilege escalation.

This issue affects Junos OS:

All versions before 22.4R3-S7,  from 23.2 before 23.2R2-S4,  from 23.4 before 23.4R2-S6, from 24.2 before 24.2R1-S2, 24.2R2,  from 24.4 before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

All versions before 22.4R3-S7-EVO,  from 23.2 before 23.2R2-S4-EVO,  from 23.4 before 23.4R2-S6-EVO, from 24.2 before 24.2R2-EVO,  from 24.4 before 24.4R1-S1-EVO, 24.4R2-EVO.