Junos OS Evolved CVE-2025-60006

Exploitation requires an existing authenticated Junos OS Evolved CLI session with at least low (restricted/non-root) privileges (PR:L) and local access to the device CLI (AV:L) - remote unauthenticated exploitation is not possible. The specific trigger is crafting CLI commands whose option values are processed by unhardened backend scripts that pass arguments to the shell, allowing shell-metacharacter injection. Only Junos OS Evolved (NOT classic Junos OS) in the 24.2 branch before 24.2R2-S2-EVO and the 24.4 branch before 24.4R2-EVO is affected; versions earlier than 24.2R1-EVO are explicitly not affected. Limiting factors: the attacker must already possess valid CLI credentials, must be local to the system, and the resulting impact is bounded (LOW confidentiality/integrity/availability - a permission-boundary bypass rather than full root compromise).

Real-world risk is moderate-to-low despite the serious vulnerability class (CWE-78 OS command injection). The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) is the decisive signal: exploitation requires LOCAL access (AV:L) and existing authenticated CLI privileges (PR:L), and impact is only LOW across confidentiality, integrity, and availability - consistent with a limited privilege-escalation/permission-bypass rather than full device takeover. The vendor score of 4.8 (MEDIUM) reflects this gated, bounded impact. EPSS is 0.99% (61st percentile), which is slightly elevated among CVEs but still low in absolute terms, indicating no mass-exploitation pressure. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is not an urgent, widely-weaponized issue. The AU:Y (user-interaction-independent/automatable-adjacent) flag in the 4.0 vector and the self-report by Juniper SIRT (sirt@juniper.net) point to a vendor-discovered, responsibly-disclosed issue. Net: prioritize as routine patching for Junos OS Evolved operators, not emergency response - the local-access and authenticated-privilege prerequisites substantially limit the realistic attacker population to insiders or those who already hold a foothold.

An attacker who already holds a restricted (non-root) Junos OS Evolved CLI account - for example a limited operator or a compromised low-privilege login - issues crafted CLI commands whose options are passed to unhardened backend scripts. Shell metacharacters embedded in those options are interpreted by the shell, letting the attacker run commands or reach data beyond their assigned permission class. No public exploit code is identified at time of analysis, and the attack requires local, authenticated CLI access.