CVE-2026-33785

MEDIUM EPSS 3.5%
Published Apr 9, 20262mo ago · Modified Jun 17, 20261w ago
6.3 CVSS 4.0
Medium
Find Similar
Published Apr 9, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices. Any user logged in, without requiring specific privileges, can issue 'request csds' CLI operational commands. These commands are only meant to be executed by high privileged or users designated for Juniper Device Manager (JDM) / Connected Security Distributed Services (CSDS) operations as they will impact all aspects of the devices managed via the respective MX. This issue affects Junos OS on MX Series: * 24.4 releases before 24.4R2-S3,  * 25.2 releases before 25.2R2. This issue does not affect Junos OS releases before 24.4.

CVSS Details

Base Score
6.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
3.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 22

VendorProductVersionRange
juniperjunos24.4any
juniperjunos24.4any
juniperjunos24.4any
juniperjunos24.4any
juniperjunos24.4any
juniperjunos24.4any
juniperjunos24.4any
juniperjunos25.2any
juniperjunos25.2any
juniperjunos25.2any
juniperjunos25.2any
junipermx10004*any
junipermx10008*any
junipermx2008*any
junipermx2010*any
junipermx2020*any
junipermx204*any
junipermx240*any
junipermx301*any
junipermx304*any
junipermx480*any
junipermx960*any

References 1

  • kb.juniper.net https://kb.juniper.net/JSA107872
    MitigationVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.