EUVD-2026-42703
GHSA-4c4g-46p8-24mq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Local CLI access required (AV:L), any authenticated account suffices (PR:L), and impact is purely availability disruption with no confidentiality or integrity effect (C:N/I:N/A:H).
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a local, authenticated attacker to cause a Denial-of-Service (DoS).
On EX2300, EX4000, EX4100, EX4300-MP (Multigigabit) and EX4400 switches, an authenticated, local attacker with no specific permissions or class can execute a specific, privileged CLI 'request' command which will cause complete traffic impact until the system automatically recovers.
This issue affects Junos OS on EX2300, EX4000, EX4100, EX4300-MP (Multigigabit) and EX4400:
- 23.2R2 versions before 23.2R2-S6,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S4,
- 24.4 versions before 24.4R2-S3,
- 25.2 versions before 25.2R2,
- 25.4 versions before 25.4R1-S1.
AnalysisAI
Junos OS on Juniper EX Series access switches exposes a missing authorization flaw in the CLI that allows any locally authenticated user, regardless of privilege class or assigned permissions, to execute a specific privileged 'request' command and cause complete traffic disruption on the affected switch. Affected platforms span EX2300, EX4000, EX4100, EX4300-MP, and EX4400 across six active Junos OS release trains from 23.2 through 25.4. No public exploit has been identified at time of analysis and the system recovers automatically, but the low barrier to exploitation - any authenticated local user qualifies - makes this a meaningful insider threat in shared-access or multi-tenant switch environments.
Technical ContextAI
The root cause is CWE-862 (Missing Authorization), where the Junos OS CLI fails to enforce privilege-class or permission checks before permitting execution of a specific 'request' command that is ordinarily restricted to privileged operators. Junos OS login classes define what commands each user can run; this vulnerability bypasses that enforcement for the affected command. The impacted hardware (CPE: cpe:2.3:a:juniper_networks:junos_os) comprises the EX2300, EX4000, EX4100, EX4300-MP (Multigigabit), and EX4400 - all enterprise-grade access-layer Ethernet switches commonly deployed in campus and branch networks. The vulnerability is specific to these platforms and does not appear to extend to all Junos OS deployments, suggesting a platform-specific code path or CLI handler is involved. The DoS condition causes complete traffic impact, implying the command likely triggers a forwarding-plane reset or similar hardware-level disruption, from which the system automatically recovers.
RemediationAI
The primary fix is to upgrade to a corrected Junos OS release for the applicable train: 23.2R2-S6 or later, 23.4R2-S8 or later, 24.2R2-S4 or later, 24.4R2-S3 or later, 25.2R2 or later, or 25.4R1-S1 or later. Full details are available in Juniper advisory JSA110077 at https://supportportal.juniper.net/JSA110077. If immediate patching is not feasible, compensating controls should include restricting CLI access to the minimum set of required user accounts and enforcing command authorization via TACACS+ or RADIUS, which allows per-user or per-group restrictions on which 'request' commands can be executed - potentially blocking the vulnerable command path. Note that TACACS+ command authorization requires correct policy configuration and testing, as overly broad allow-lists may not block the specific command. Additionally, audit existing local Junos accounts and remove unnecessary accounts to reduce the attack surface. Be aware that removing CLI access for operational users may impact network management workflows.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today