Riskcovery

CVE-2021-0253

Junos OS: NFX Series: Local Command Execution Vulnerability in JDMD Leads to Privilege Escalation

State
Published
Severity
7.8 High
Published
Apr 22, 2021
Updated
Sep 16, 2024
Reserved
Oct 27, 2020

Read the record on cve.org

Description

NFX Series devices using Juniper Networks Junos OS are susceptible to a local command execution vulnerability thereby allowing an attacker to elevate their privileges via the Junos Device Management Daemon (JDMD) process. This issue affects Juniper Networks Junos OS on NFX Series 17.2 version 17.2R1 and later versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R2-S5, 18.4R3-S5; 19.1 versions prior to 19.1R1-S3; 19.2 version 19.1R2 and later versions prior to 19.2R3; 19.3 versions prior to 19.3R3; 19.4 versions prior to 19.4R2-S2. 19.4 versions 19.4R3 and above. This issue does not affect Juniper Networks Junos OS versions prior to 17.2R1. This issue does not affect the JDMD as used by Junos Node Slicing such as External Servers use in conjunction with Junos Node Slicing and In-Chassis Junos Node Slicing on MX480, MX960, MX2008, MX2010, MX2020.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hjuniper

Weaknesses

  • CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Affected Products

ProductVersions
Junos OSJuniper Networks
  • before 18.3R3-S4Affected
  • 17.2R1 to before 17.2*Affected
  • 18.4 to before 18.4R2-S5, 18.4R3-S5Affected
  • 19.1 to before 19.1R1-S3Affected
  • 19.1R2 to before 19.2*Affectedfrom 19.2R3Not affected
  • 19.3 to before 19.3R3Affected
  • 19.4 to before 19.4R2-S2Affectedfrom 19.4R3Affected
Junos OSJuniper Networks
  • before 17.2R1Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.