CVE-2021-0223

Junos OS: telnetd.real Local Privilege Escalation vulnerabilities in SUID binaries

State: Published
Severity: 7.8 High
Published: Jan 15, 2021
Updated: Sep 17, 2024
Reserved: Oct 27, 2020

Description

A local privilege escalation vulnerability in telnetd.real of Juniper Networks Junos OS may allow a locally authenticated shell user to escalate privileges and execute arbitrary commands as root. telnetd.real is shipped with setuid permissions enabled and is owned by the root user, allowing local users to run telnetd.real with root privileges. This issue affects Juniper Networks Junos OS: all versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R2-S4, 18.3R3-S4; 18.4 versions prior to 18.4R2-S7, 18.4R3-S6; 19.1 versions prior to 19.1R2-S2, 19.1R3-S4; 19.2 versions prior to 19.2R1-S6, 19.2R3-S1; 19.3 versions prior to 19.3R3-S1; 19.4 versions prior to 19.4R2-S2, 19.4R3; 20.1 versions prior to 20.1R1-S4, 20.1R2; 20.2 versions prior to 20.2R2.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	juniper

Weaknesses

CWE-250 Execution with Unnecessary Privileges

Affected Products

Product	Versions
Junos OSJuniper Networks	before 15.1R7-S9Affected 17.3 to before 17.3R3-S11Affected 17.4 to before 17.4R2-S12, 17.4R3-S3Affected 18.1 to before 18.1R3-S11Affected 18.2 to before 18.2R3-S6Affected 18.3 to before 18.3R2-S4, 18.3R3-S4Affected 18.4 to before 18.4R2-S7, 18.4R3-S6Affected 19.1 to before 19.1R2-S2, 19.1R3-S4Affected 19.2 to before 19.2R1-S6, 19.2R3-S1Affected 19.3 to before 19.3R3-S1Affected 19.4 to before 19.4R2-S2, 19.4R3Affected 20.1 to before 20.1R1-S4, 20.1R2Affected 20.2 to before 20.2R2Affected

Product

Versions

Junos OSJuniper Networks

before 15.1R7-S9Affected
17.3 to before 17.3R3-S11Affected
17.4 to before 17.4R2-S12, 17.4R3-S3Affected
18.1 to before 18.1R3-S11Affected
18.2 to before 18.2R3-S6Affected
18.3 to before 18.3R2-S4, 18.3R3-S4Affected
18.4 to before 18.4R2-S7, 18.4R3-S6Affected
19.1 to before 19.1R2-S2, 19.1R3-S4Affected
19.2 to before 19.2R1-S6, 19.2R3-S1Affected
19.3 to before 19.3R3-S1Affected
19.4 to before 19.4R2-S2, 19.4R3Affected
20.1 to before 20.1R1-S4, 20.1R2Affected
20.2 to before 20.2R2Affected

References

https://kb.juniper.net/JSA11114

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.