CVE-2026-33791
MediumCVSS 6.7Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
An OS Command Injection vulnerability in CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker to execute crafted CLI commands and inject arbitrary shell commands as root. Certain 'set system' commands are not properly sanitized.
Risk Assessment
Potential full system compromise by a high-privileged attacker, leading to complete device takeover.
Recommendation
Update Junos OS and Junos OS Evolved to fixed releases (e.g. 22.4R3-S8, 23.2R2-S5, 23.4R2-S7, 24.2R2-S2, 24.4R2, 25.2R2 or corresponding EVO versions).
Other vulnerabilities in Junos OS
See all- CVE-2026-21917High
A vulnerability in the Web-Filtering module of Junos OS on SRX Series allows an unauthenticated network-based attacker to cause a Denial-of-Service (DoS). A specially crafted SSL packet causes an FPC crash and restart.
- CVE-2026-21913High
A vulnerability in Juniper Junos OS on EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) allows an unauthenticated network-based attacker to cause an FXPC crash and restart by sending a high volume of traffic to the device. This leads to a complete service outage until the device automatically restarts.
- CVE-2026-21905High
A vulnerability in Junos OS on SRX and MX devices with MX-SPC3 or MS-MPC service cards causes an infinite loop in the flow management process (flowd or mspmand) after receiving specific SIP messages over TCP. An unauthenticated attacker can send multiple such messages, leading to watchdog timer expiration and process crash, resulting in a Denial of Service (DoS). The issue only occurs over TCP, not UDP.
- CVE-2025-60003High
A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When an affected device receives a BGP update with a set of specific optional transitive attributes over an established peering session, rpd will crash and restart when attempting to advertise the received information to another peer.
- CVE-2025-59960High
A vulnerability in the DHCP service (jdhcpd) of Junos OS and Junos OS Evolved allows a DHCP client in one subnet to exhaust the address pools of other subnets, leading to a Denial of Service (DoS) on the downstream DHCP server. The issue arises from improper handling of DHCP DISCOVER packets with Option 82 in 'forward-only' mode, which are forwarded unmodified instead of being dropped, consuming addresses from the pool.
- CVE-2016-4922High
A vulnerability in Junos OS allows unauthorized access to the operating system through certain combinations of CLI commands. Users with the appropriate permissions can achieve elevated privileges and gain complete control of the device.
- CVE-2017-2344High
An internal Junos OS sockets library is vulnerable to a buffer overflow, which may lead to a denial of service (kernel panic) or privilege escalation through local code execution. The routines are only accessible via programs running on the device.
- CVE-2017-2303High
On Juniper Networks products or platforms running Junos OS versions prior to 12.1X46-D50, 12.1X47-D40, 12.3R13, 12.3X48-D30, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D35, 14.1X55-D35, 14.2R5, 15.1F6, 15.1R3, 15.1X49-D30, 15.1X49-D40, 15.1X53-D35, where RIP is enabled, certain RIP advertisements may cause the RPD daemon to crash, resulting in a denial of service condition.
- CVE-2017-2302High
On Juniper Networks products running Junos OS versions prior to 12.1X46-D55, 12.1X47-D45, 12.3R13, 12.3X48-D35, 13.3R10, 14.1R8, 14.1X53-D40, 14.1X55-D35, 14.2R6, 15.1F2 or 15.1R1, where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network-based attacker can cause the rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition.
- CVE-2017-2301High
On Juniper Networks products running Junos OS versions prior to 11.4R13-S3, 12.1X46-D60, 12.3R12-S2, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D12, 14.1X55-D35, 14.2R7, 15.1F6, 15.1R3, 15.1X49-D60, and 15.1X53-D30, when DHCPv6 is enabled, receiving a crafted DHCPv6 packet causes the jdhcpd daemon to crash and restart. Repeated crashes of the jdhcpd process may lead to an extended denial of service condition for subscribers attempting to obtain IPv6 addresses.
Original NVD description (English source)
An OS Command Injection vulnerability in the CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker executing specific, crafted CLI commands to inject arbitrary shell commands as root, leading to a complete compromise of the system. Certain 'set system' commands, when executed with crafted arguments, are not properly sanitized, allowing for arbitrary shell injection. These shell commands are executed as root, potentially allowing for complete control of the vulnerable system. This issue affects: Junos OS: * all versions before 22.4R3-S8, * from 23.2 before 23.2R2-S5, * from 23.4 before 23.4R2-S7, * from 24.2 before 24.2R2-S2, * from 24.4 before 24.4R2, * from 25.2 before 25.2R2; Junos OS Evolved: * all versions before 22.4R3-S8-EVO, * from 23.2 before 23.2R2-S5-EVO, * from 23.4 before 23.4R2-S7-EVO, * from 24.2 before 24.2R2-S2-EVO, * from 24.4 before 24.4R2-EVO, * from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS