CVE-2022-22221

Junos OS: SRX and EX Series: Local privilege escalation flaw in "download" functionality

State: Published
Severity: 7.8 High
Published: Jul 20, 2022
Updated: Sep 17, 2024
Reserved: Dec 21, 2021

Description

An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally authenticated attacker with low privileges to take full control over the device. One aspect of this vulnerability is that the attacker needs to be able to execute any of the "request ..." or "show system download ..." commands. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: All versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2, 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R2-S2, 21.2R3; 21.3 versions prior to 21.3R2, 21.3R3; 21.4 versions prior to 21.4R1-S1, 21.4R2.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	juniper

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Junos OSJuniper Networks	before 19.1R3-S9Affected 19.2 to before 19.2R1-S9, 19.2R3-S5Affected 19.3 to before 19.3R3-S6Affected 19.4 to before 19.4R3-S8Affected 20.1 to before 20.1R3-S4Affected 20.2 to before 20.2R3-S4Affected 20.3 to before 20.3R3-S3Affected 20.4 to before 20.4R3-S2, 20.4R3-S3Affected 21.1 to before 21.1R3-S1Affected 21.2 to before 21.2R2-S2, 21.2R3Affected 21.3 to before 21.3R2, 21.3R3Affected 21.4 to before 21.4R1-S1, 21.4R2Affected

Product

Versions

Junos OSJuniper Networks

before 19.1R3-S9Affected
19.2 to before 19.2R1-S9, 19.2R3-S5Affected
19.3 to before 19.3R3-S6Affected
19.4 to before 19.4R3-S8Affected
20.1 to before 20.1R3-S4Affected
20.2 to before 20.2R3-S4Affected
20.3 to before 20.3R3-S3Affected
20.4 to before 20.4R3-S2, 20.4R3-S3Affected
21.1 to before 21.1R3-S1Affected
21.2 to before 21.2R2-S2, 21.2R3Affected
21.3 to before 21.3R2, 21.3R3Affected
21.4 to before 21.4R1-S1, 21.4R2Affected

References

https://kb.juniper.net/JSA69725

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.