Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveJuniperCVE-2024-39522
HistoryJul 11, 2024 - 4:15 p.m.

CVE-2024-39522

2024-07-1116:15:03
CWE-78
juniper
web.nvd.nist.gov
26
juniper networks junos os evolved
cli
vulnerability
authentication
privilege escalation
cve-2024-39522

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

EPSS

0

Percentile

9.9%

JSON

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to ‘root’ leading to a full compromise of the system.

The Junos OS Evolved CLI doesn’t properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

  • 22.3-EVO versions before 22.3R2-EVO,
  • 22.4-EVO versions before 22.4R1-S1-EVO, 22.4R2-EVO.

Affected configurations

Nvd
Node
juniperjunos_os_evolvedMatch22.3-
OR
juniperjunos_os_evolvedMatch22.3r1
OR
juniperjunos_os_evolvedMatch22.3r1-s1
OR
juniperjunos_os_evolvedMatch22.3r1-s2
OR
juniperjunos_os_evolvedMatch22.4-
OR
juniperjunos_os_evolvedMatch22.4r1
VendorProductVersionCPE
juniperjunos_os_evolved22.3cpe:2.3:o:juniper:junos_os_evolved:22.3:-:*:*:*:*:*:*
juniperjunos_os_evolved22.3cpe:2.3:o:juniper:junos_os_evolved:22.3:r1:*:*:*:*:*:*
juniperjunos_os_evolved22.3cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s1:*:*:*:*:*:*
juniperjunos_os_evolved22.3cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s2:*:*:*:*:*:*
juniperjunos_os_evolved22.4cpe:2.3:o:juniper:junos_os_evolved:22.4:-:*:*:*:*:*:*
juniperjunos_os_evolved22.4cpe:2.3:o:juniper:junos_os_evolved:22.4:r1:*:*:*:*:*:*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Junos OS Evolved",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "22.3R2-EVO",
        "status": "affected",
        "version": "22.3-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "22.4R1-S1-EVO, 22.4R2-EVO",
        "status": "affected",
        "version": "22.4-EVO",
        "versionType": "semver"
      }
    ]
  }
]

Related

nvd 1
vulnrichment 1
cvelist 1
nessus 1
nvd
nvd
CVE-2024-39522
2024-07-11 16:15:03
vulnrichment
vulnrichment
CVE-2024-39522 Junos OS Evolved: CLI parameter processing issue allows privilege escalation
2024-07-11 15:58:26
cvelist
cvelist
CVE-2024-39522 Junos OS Evolved: CLI parameter processing issue allows privilege escalation
2024-07-11 15:58:26
nessus
nessus
Juniper Junos OS Multiple Vulnerabilities (JSA82975)
2024-07-10 00:00:00

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

EPSS

0

Percentile

9.9%

JSON
Related for CVE-2024-39522
nvd1vulnrichment1cvelist1nessus1