Juniper Networks Junos OS and Junos OS Evolved Missing Authorization Vulnerability Allowing Sensitive Information Disclosure

A missing authorization vulnerability has been identified in the CLI of Juniper Networks Junos OS and Junos OS Evolved. This vulnerability allows a local user with low privileges to read sensitive information by executing the CLI command 'show mgd' with specific arguments. The issue affects all versions of Junos OS prior to 22.4R3-S8, as well as certain versions in the 23.x, 24.x, and 25.x series. In Junos OS Evolved, all versions prior to 23.2R2-S6-EVO, as well as specific versions in the 23.x, 24.x, and 25.x series, are affected.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information.

Remediation

Users can upgrade to Junos OS versions 22.4R3-S8, 23.2R2-S6, 23.4R2-S6, 24.2R2-S4, 24.4R2-S1, 25.2R1-S2, 25.2R2, 25.4R1, and all subsequent releases. For Junos OS Evolved, users can upgrade to versions 23.2R2-S6-EVO, 23.4R2-S6-EVO, 24.2R2-S4-EVO, 24.4R2-S1-EVO, 25.2R2-EVO, 25.4R1-EVO, and all subsequent releases.