CVE-2021-0252

Junos OS: NFX Series: Local Code Execution Vulnerability in JDMD Leads to Privilege Escalation

State: Published
Severity: 7.8 High
Published: Apr 22, 2021
Updated: Sep 17, 2024
Reserved: Oct 27, 2020

Description

NFX Series devices using Juniper Networks Junos OS are susceptible to a local code execution vulnerability thereby allowing an attacker to elevate their privileges via the Junos Device Management Daemon (JDMD) process. This issue affects Juniper Networks Junos OS on NFX Series: 18.1 version 18.1R1 and later versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R1-S3, 19.1R2; 19.2 versions prior to 19.2R1-S5, 19.2R2. This issue does not affect: Juniper Networks Junos OS versions prior to 18.1R1. This issue does not affect the JDMD as used by Junos Node Slicing such as External Servers use in conjunction with Junos Node Slicing and In-Chassis Junos Node Slicing on MX480, MX960, MX2008, MX2010, MX2020.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	juniper

Weaknesses

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

Product	Versions
Junos OSJuniper Networks	18.1R1 to before 18.1*Affected 18.2 to before 18.2R3-S5Affected 18.3 to before 18.3R2-S4, 18.3R3-S3Affected 18.4 to before 18.4R2-S5, 18.4R3-S4Affected 19.1 to before 19.1R1-S3, 19.1R2Affected 19.2 to before 19.2R1-S5, 19.2R2Affected
Junos OSJuniper Networks	before 18.1R1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.