Product:
Junos OS Evolved
Summary
Multiple instances of an Improper Neutralization of Special Elements used in an OS Command vulnerability in the CLI of Juniper Networks Junos OS Evolved could be used to elevate privileges and execute unauthorized commands. When an attacker executes crafted CLI commands, the options are processed via a script that is not hardened, allowing injected commands to be executed via the shell. This issue affects specific versions of Junos OS Evolved.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.8 | CVE-2025-60006 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the system and execute crafted CLI commands that are processed by the vulnerable scripts. By injecting malicious commands, the attacker can perform operations beyond their assigned permissions, potentially leading to privilege escalation or unauthorized command execution.
Affected Products
- Junos OS Evolved 24.2 versions before 24.2R2-S2-EVO
- Junos OS Evolved 24.4 versions before 24.4R2-EVO
Mitigation
To mitigate this vulnerability, it is recommended to upgrade to the latest versions of Junos OS Evolved that are not affected by this issue. Regularly applying security patches and following best practices for system access can also help reduce the risk of exploitation.