Product Affected

This issue affects all versions of Junos OS.
Medium

CVSS: v3.1: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVSS: v4.0: 8.4 (CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:N/R:A/V:C/RE:M/U:Amber)

Problem

A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain access to Linux-based line cards as root.

This issue affects systems running Junos OS using Linux-based line cards. Affected line cards include:

  • MPC7, MPC8, MPC9, MPC10, MPC11
  • LC2101, LC2103
  • LC480, LC4800, LC9600
  • MX304 (built-in FPC)
  • MX-SPC3
  • EX9200-40XS

  • FPC3-PTX-U2, FPC3-PTX-U3
  • FPC3-SFF-PTX
  • LC1101, LC1102, LC1104, LC1105

SRX Series devices such as the SRX5K are unaffected by this vulnerability.

 

This issue affects Junos OS: 

  • all versions before 22.4R3-S8, 
  • from 23.2 before 23.2R2-S6, 
  • from 23.4 before 23.4R2-S6, 
  • from 24.2 before 24.2R2-S3, 
  • from 24.4 before 24.4R2,
  • from 25.2 before 25.2R2.

 

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

Solution

The following software releases have been updated to resolve this specific issue: 22.4R3-S8, 23.2R2-S6, 23.4R2-S6, 24.2R2-S3, 24.4R2, 25.2R2, 25.4R1, and all subsequent releases.

 

This issue is being tracked as 1872703, which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases that are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for this issue.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2026-04-08: Initial Publication
2026-04-13: Removed reference to EVO. Issue is specific to Junos OS with Linux-based line cards.
2026-04-28: Confirmed that SRX systems, such as the SRX5800, are unaffected by this vulnerability.

Related Information

Acknowledgements

Juniper SIRT would like to acknowledge and thank Pierre EMERIAUD & Orange CERT-CC from Orange group for responsibly reporting this vulnerability.