Lucene search

JuniperCVELIST:CVE-2024-39521

HistoryJul 11, 2024 - 3:57 p.m.

CVE-2024-39521 Junos OS Evolved: CLI parameter processing issue allows privilege escalation

2024-07-1115:57:44

CWE-78

juniper

www.cve.org

juniper networks

cli parameter processing

vulnerability

privilege escalation

local attacker

system compromise

command options

cve-2024-39521

junos os evolved

21.1-evo

21.4-evo

22.1-evo

22.2-evo

22.3-evo

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

EPSS

Percentile

9.9%

JSON

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to ‘root’ leading to a full compromise of the system.

The Junos OS Evolved CLI doesn’t properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

21.1-EVO versions 21.1R1-EVO and later before 21.2R3-S8-EVO,
21.4-EVO versions before 21.4R3-S7-EVO,
22.1-EVO versions before 22.1R3-S6-EVO,
22.2-EVO versions before 22.2R3-EVO,
22.3-EVO versions before 22.3R2-EVO.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Junos OS Evolved",
    "vendor": "Juniper Networks",
    "versions": [
      {
        "lessThan": "21.2R3-S8-EVO",
        "status": "affected",
        "version": "21.1-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "21.4R3-S7-EVO",
        "status": "affected",
        "version": "21.4-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "22.1R3-S6-EVO",
        "status": "affected",
        "version": "22.1-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "22.2R3-EVO",
        "status": "affected",
        "version": "22.2-EVO",
        "versionType": "semver"
      },
      {
        "lessThan": "22.3R2-EVO",
        "status": "affected",
        "version": "22.3-EVO",
        "versionType": "semver"
      }
    ]
  }
]

References

supportportal.juniper.net/JSA82975

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

EPSS

Percentile

9.9%

JSON

Related for CVELIST:CVE-2024-39521