Junos OS EUVD-2026-101465

Exploitation requires an authenticated, low-privileged Junos OS CLI account (PR:L) on the affected device and the ability to invoke the specific 'request csds' command - the injection occurs through unsanitized arguments to that command. It is further limited to Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3); releases before 24.4R1 are explicitly not affected. The vector is local (AV:L) with no remote/network path and no user interaction, so the key limiting factor is that the attacker must first obtain local CLI credentials; there is no path for an unauthenticated remote attacker.

This is a serious but access-gated issue, not an internet-facing emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms the attack vector is LOCAL, not network - an attacker must already have CLI access to the device with low (but non-zero) privileges. The reward is high: command injection in the 'request csds' handler yields full root-level code execution (VC:H/VI:H/VA:H), effectively a privilege escalation from a constrained operator account to complete device control. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or widespread automated attack. The realistic risk is therefore 'privilege escalation / insider or post-compromise lateral movement' rather than 'remotely wormable.' One consistency note: the CVSS vector (AV:L) and the description ('local, low privileged attacker') agree, so the primary limiting factor - prior authenticated local CLI access - is well-supported by the data. Prioritize patching on devices where low-privileged operator accounts are delegated to third parties or where the management plane is broadly accessible.

An attacker holding a low-privileged Junos CLI account (for example a delegated network operator or a credential obtained via phishing) runs the 'request csds' command with a crafted argument containing shell metacharacters. Because the input is passed unsanitized to an OS command, the injected payload executes with root privileges, giving the attacker complete control of the router/switch. No public exploit code was identified at time of analysis, but the technique (CWE-78 argument injection) is straightforward to reproduce once CLI access exists.