Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2026-102079

Junos OS: MX Series: Missing Authorization for specific 'request' CLI commands allows command injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
juniper

Description

An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification. This issue affects Junos OS: * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3; This issue does not affect Junos OS releases before 24.4R1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Juniper Networks Junos OS

Default version status: unaffected

  • 24.4 to < 24.4R2-S4affected
  • 25.2 to < 25.2R2-S1affected
  • 25.4 to < 25.4R1-S3affected

References