Juniper Networks
Monthly
Heap memory disclosure and multicast join-state injection in Juniper Junos OS running on EX Series and MX Series platforms, and in Junos OS Evolved on ACX Series, arise from an integer underflow in the rpd routing daemon that can be triggered by an unauthenticated attacker on an adjacent network segment sending a malformed draft-Rosen MVPN message. Only devices that actually support and have draft-Rosen MVPN configured and active are exposed, which bounds the affected population; impact is limited to low-level confidentiality and integrity loss (assessed CVSS 3.1 base 5.3, AV:A/AC:L/PR:N/UI:N/C:L/I:L/A:N) rather than device takeover or denial of service. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so this is a moderate, patch-in-normal-cycle priority rather than an emergency, especially since vendor fixes are already published.
Out-of-bounds read in the rpd routing process of Juniper Junos OS and Junos OS Evolved allows an adjacent attacker to disclose limited rpd process memory and disrupt a single LDP adjacency via a crafted IPv6 LDP message. The flaw affects numerous Junos OS and Evolved branches, with fixed versions available per Juniper advisory JSA112187. No public exploit code has been identified at time of analysis; exploitation requires the target to have LDP with IPv6 enabled and an attacker on the same network segment, making this a moderate-severity, limited-impact issue.
An out-of-bounds write in the eventd relay service of Juniper Junos OS and Junos OS Evolved allows an attacker who already holds high-privilege local access on the device to crash the event-processing daemon, causing a denial of service. Our independent assessment (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) confirms the attack is local rather than remote, requires high privileges, needs no user interaction, and affects availability only with no confidentiality or integrity impact and only a low downstream system-availability effect. There is no public exploit identified at time of analysis, no CISA KEV entry confirms active exploitation, and the vendor-rated CVSS 4.0 base score of 6.7 places this in the medium-severity range.
Malformed clock-synchronization messages delivered over SyncE or PTP can crash the clksyncd daemon and trigger persistent Routing Engine switchovers on Juniper MX Series devices running vulnerable Junos OS releases that are equipped with an SCBE3 Switch Control Board and configured for external clock synchronization. The attacker must be logically adjacent (CVSS AV:A) - sitting as, or controlling, the upstream timing node that feeds the victim's clock path - and no authentication is required (PR:N), but the trigger is a race condition that Juniper itself describes as outside the attacker's direct control (AC:H), so the resulting denial of service is non-deterministic rather than reliably forcible. Impact is purely availability (C:N/I:N/A:H); devices without SCBE3, or not running SyncE/PTP, are unaffected, and no public exploit code or active exploitation has been identified at time of analysis. This is a genuine but modest-priority issue, not a top-tier emergency.
Junos OS Evolved releases before the fixed builds listed in Juniper advisory JSA112171 unintentionally bind an internal-only process to a network-reachable port, letting an unauthenticated, network-based attacker achieve limited information disclosure and increase CPU consumption through ingress packet processing. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, score 6.5) confirms no authentication or user interaction is required, but exploitation is constrained by whether the exposed port is actually routable from the attacker's position; devices with that port firewalled or limited to internal/management networks are not practically exploitable. No public exploit has been identified at time of analysis and CISA KEV does not list this issue, so the risk is best characterized as moderate and exposure-dependent rather than an active compromise campaign.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.
A malformed BGP-LS UPDATE message can cause the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) to leak small amounts of heap memory to an adjacent, already-peered BGP-LS speaker. Only devices that have an established BGP-LS session with the traffic-engineering address family explicitly enabled are exposed, and the attacker must itself be a configured BGP-LS peer, so this is not reachable by arbitrary remote hosts and is not a default configuration. Impact is limited to low-severity confidentiality loss (CVSS 3.1, AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect, no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status.
Memory disclosure and denial of service in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved can be triggered by malformed ICCP packets, allowing an attacker with adjacent access to an established Inter-Chassis Communication Protocol peer session to leak memory contents and disrupt the daemon. The vendor-rated CVSS 4.3 (Medium) reflects impact limited to confidentiality and availability, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, with the caveat that exploitation requires the device to be running a multichassis configuration that actively uses ICCP (for example MC-LAG) and that the attacker be logically adjacent on the inter-chassis control plane; standalone routers without ICCP are unaffected. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), so this is a genuinely low-to-moderate priority issue consistent with its 4.3 score, though the memory disclosure component means it should not be dismissed purely on availability impact.
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network attackers by allowing a specially formatted URL to evade the URL filtering plugin. The flaw stems from incorrect name or reference resolution (CWE-706), causing the router to forward traffic that security policy mandates be dropped. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 6.9 carries an Automatable:Yes modifier, indicating the bypass is scriptable at scale against any qualifying deployment.
Ingress firewall filter bypass in Juniper Networks Junos OS on MX Series hardware (MPC10/11, LC4800/9600/4802, MX304) allows adjacent subscribers on static interfaces to evade configured protocol-level access controls and upstream bandwidth limitations. The Packet Forwarding Engine (PFE) fails to enforce ingress filters for these subscriber configurations, meaning neither protocol restrictions nor rate-limiting policies take effect. No public exploit code has been identified and the vulnerability is absent from CISA KEV, though the CVSS 4.0 AU:Y (Automatable) supplemental metric indicates exploitation could be scripted at scale against affected broadband aggregation deployments.
Traffic forwarding on Juniper QFX Series switches running Junos OS Evolved can be fully disrupted by an adjacent, unauthenticated attacker exploiting a race condition in the sFlow collector handler. When sFlow collector reachability changes trigger a next-hop entry update concurrently with the sFlow thread reading that same next-hop data, the evo-pfemand process crashes and all packet forwarding halts until the process automatically restarts. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis, but the availability impact is severe for any network segment relying on the affected switch.
License exhaustion in Juniper Networks Junos OS Evolved lets an unauthenticated, network-based attacker reach the device's license-management process, which was intended to be internal-only but is exposed on an open network port due to incorrect initialization. All Junos OS Evolved releases before 23.2R2-EVO are affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible network-facing denial-of-service risk to affected routing/switching platforms.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a local, low-privileged attacker to crash the l2ald (Layer 2 Address Learning Daemon) by issuing a specific 'show l2-learning' CLI command, disrupting all Layer 2 services until the process automatically restarts. The root cause is a Return of Pointer Value Outside of Expected Range flaw (CWE-466) in the fileio library. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA or the vendor.
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that assigns duplicate index values to new peers, triggering continuous iked process crashes and a full VPN service outage requiring system reboot. Unauthenticated network-based attackers can deliberately flood the device with failing VPN negotiations to accelerate the rollover condition. No public exploit code or CISA KEV listing exists at time of analysis, but the network-reachable, zero-privilege attack vector makes this a meaningful risk for any organization relying on Juniper-based VPN infrastructure with iked enabled.
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes the process when handling crafted network requests, taking down all web-management-dependent services including J-Web, remote-access VPN, and firewall authentication until automatic process recovery. Exploitation is gated on a specific non-default configuration - remote-access VPN with pre-logon compliance check enabled - limiting the exposed population to SRX deployments that actively use this feature. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the official CVSS 5.3 score reflects the limited, reversible availability-only impact.
Junos OS Evolved exposes an internal communication process to the network via an unintended open port due to incorrect initialization, enabling unauthenticated remote attackers to interact with a service never designed for external access. Affected Juniper devices suffer limited information disclosure and elevated CPU consumption as the misbound process handles unsolicited ingress packets - a soft availability degradation rather than a crash. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the unauthenticated network vector across a broad version range warrants prompt patching on internet-facing routing infrastructure.
Junos OS on Juniper EX Series access switches exposes a missing authorization flaw in the CLI that allows any locally authenticated user, regardless of privilege class or assigned permissions, to execute a specific privileged 'request' command and cause complete traffic disruption on the affected switch. Affected platforms span EX2300, EX4000, EX4100, EX4300-MP, and EX4400 across six active Junos OS release trains from 23.2 through 25.4. No public exploit has been identified at time of analysis and the system recovers automatically, but the low barrier to exploitation - any authenticated local user qualifies - makes this a meaningful insider threat in shared-access or multi-tenant switch environments.
Packet forwarding engine (pfe) in Juniper Networks Junos OS on EX4100, EX4400, EX4650, and QFX5120 devices fails to correctly initialize egress filters on IRB and physical interfaces, allowing unauthenticated network-based attackers to bypass security policies and cause integrity impact by forwarding traffic that should be blocked. The vulnerability affects Junos OS versions 23.4R2-S6 and 24.2R2-S3. EPSS score of 6.9 reflects moderate exploitation probability; no active exploitation confirmed (non-KEV status).
Denial of service in Juniper Junos OS chassis control daemon (chassisd) on SRX1600, SRX2300, and SRX4300 devices allows local attackers with low privileges to trigger a complete crash via a specific 'show chassis' CLI command, causing temporary traffic disruption until module recovery. Junos OS 24.4 versions before 24.4R1-S3 and 24.4R2 are affected; no public exploit code identified at time of analysis.
Stored cross-site scripting (XSS) in Juniper Networks Junos Space allows unauthenticated remote attackers to inject malicious script tags into the list filter field, which execute with the permissions of any user who views the affected page, including administrators. All versions before 24.1R5 Patch V3 are vulnerable. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated buffer overflow in Juniper Networks Junos OS Evolved advanced forwarding toolkit (evo-aftmand/evo-pfemand) permits adjacent attackers to crash PTX Series and QFX5000 Series devices via crafted multicast packets. Exploitation triggers line card or device restart, sustaining denial of service under continuous attack. Affects multiple Junos OS Evolved release branches before patched versions. No public exploit identified at time of analysis. Attack requires adjacent network access but no authentication, making exploitation feasible in shared network segments.
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-based line cards running Junos OS Evolved. Missing authentication in critical command processing functions enables authenticated administrators with elevated privileges to bypass access controls and execute commands as root on affected hardware modules including MPC7-11, LC2101/2103, LC480/4800/9600, MX304 built-in FPC, MX-SPC3, SRX5K-SPC3, EX9200-40XS, and PTX-series line cards. No public exploit identified at time of analysis.
Heap memory disclosure and multicast join-state injection in Juniper Junos OS running on EX Series and MX Series platforms, and in Junos OS Evolved on ACX Series, arise from an integer underflow in the rpd routing daemon that can be triggered by an unauthenticated attacker on an adjacent network segment sending a malformed draft-Rosen MVPN message. Only devices that actually support and have draft-Rosen MVPN configured and active are exposed, which bounds the affected population; impact is limited to low-level confidentiality and integrity loss (assessed CVSS 3.1 base 5.3, AV:A/AC:L/PR:N/UI:N/C:L/I:L/A:N) rather than device takeover or denial of service. No public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation (CISA KEV), so this is a moderate, patch-in-normal-cycle priority rather than an emergency, especially since vendor fixes are already published.
Out-of-bounds read in the rpd routing process of Juniper Junos OS and Junos OS Evolved allows an adjacent attacker to disclose limited rpd process memory and disrupt a single LDP adjacency via a crafted IPv6 LDP message. The flaw affects numerous Junos OS and Evolved branches, with fixed versions available per Juniper advisory JSA112187. No public exploit code has been identified at time of analysis; exploitation requires the target to have LDP with IPv6 enabled and an attacker on the same network segment, making this a moderate-severity, limited-impact issue.
An out-of-bounds write in the eventd relay service of Juniper Junos OS and Junos OS Evolved allows an attacker who already holds high-privilege local access on the device to crash the event-processing daemon, causing a denial of service. Our independent assessment (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) confirms the attack is local rather than remote, requires high privileges, needs no user interaction, and affects availability only with no confidentiality or integrity impact and only a low downstream system-availability effect. There is no public exploit identified at time of analysis, no CISA KEV entry confirms active exploitation, and the vendor-rated CVSS 4.0 base score of 6.7 places this in the medium-severity range.
Malformed clock-synchronization messages delivered over SyncE or PTP can crash the clksyncd daemon and trigger persistent Routing Engine switchovers on Juniper MX Series devices running vulnerable Junos OS releases that are equipped with an SCBE3 Switch Control Board and configured for external clock synchronization. The attacker must be logically adjacent (CVSS AV:A) - sitting as, or controlling, the upstream timing node that feeds the victim's clock path - and no authentication is required (PR:N), but the trigger is a race condition that Juniper itself describes as outside the attacker's direct control (AC:H), so the resulting denial of service is non-deterministic rather than reliably forcible. Impact is purely availability (C:N/I:N/A:H); devices without SCBE3, or not running SyncE/PTP, are unaffected, and no public exploit code or active exploitation has been identified at time of analysis. This is a genuine but modest-priority issue, not a top-tier emergency.
Junos OS Evolved releases before the fixed builds listed in Juniper advisory JSA112171 unintentionally bind an internal-only process to a network-reachable port, letting an unauthenticated, network-based attacker achieve limited information disclosure and increase CPU consumption through ingress packet processing. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, score 6.5) confirms no authentication or user interaction is required, but exploitation is constrained by whether the exposed port is actually routable from the attacker's position; devices with that port firewalled or limited to internal/management networks are not practically exploitable. No public exploit has been identified at time of analysis and CISA KEV does not list this issue, so the risk is best characterized as moderate and exposure-dependent rather than an active compromise campaign.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.
A malformed BGP-LS UPDATE message can cause the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) to leak small amounts of heap memory to an adjacent, already-peered BGP-LS speaker. Only devices that have an established BGP-LS session with the traffic-engineering address family explicitly enabled are exposed, and the attacker must itself be a configured BGP-LS peer, so this is not reachable by arbitrary remote hosts and is not a default configuration. Impact is limited to low-severity confidentiality loss (CVSS 3.1, AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) with no integrity or availability effect, no public exploit identified at time of analysis, and no confirmed actively exploited (CISA KEV) status.
Memory disclosure and denial of service in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved can be triggered by malformed ICCP packets, allowing an attacker with adjacent access to an established Inter-Chassis Communication Protocol peer session to leak memory contents and disrupt the daemon. The vendor-rated CVSS 4.3 (Medium) reflects impact limited to confidentiality and availability, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, with the caveat that exploitation requires the device to be running a multichassis configuration that actively uses ICCP (for example MC-LAG) and that the attacker be logically adjacent on the inter-chassis control plane; standalone routers without ICCP are unaffected. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), so this is a genuinely low-to-moderate priority issue consistent with its 4.3 score, though the memory disclosure component means it should not be dismissed purely on availability impact.
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network attackers by allowing a specially formatted URL to evade the URL filtering plugin. The flaw stems from incorrect name or reference resolution (CWE-706), causing the router to forward traffic that security policy mandates be dropped. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 6.9 carries an Automatable:Yes modifier, indicating the bypass is scriptable at scale against any qualifying deployment.
Ingress firewall filter bypass in Juniper Networks Junos OS on MX Series hardware (MPC10/11, LC4800/9600/4802, MX304) allows adjacent subscribers on static interfaces to evade configured protocol-level access controls and upstream bandwidth limitations. The Packet Forwarding Engine (PFE) fails to enforce ingress filters for these subscriber configurations, meaning neither protocol restrictions nor rate-limiting policies take effect. No public exploit code has been identified and the vulnerability is absent from CISA KEV, though the CVSS 4.0 AU:Y (Automatable) supplemental metric indicates exploitation could be scripted at scale against affected broadband aggregation deployments.
Traffic forwarding on Juniper QFX Series switches running Junos OS Evolved can be fully disrupted by an adjacent, unauthenticated attacker exploiting a race condition in the sFlow collector handler. When sFlow collector reachability changes trigger a next-hop entry update concurrently with the sFlow thread reading that same next-hop data, the evo-pfemand process crashes and all packet forwarding halts until the process automatically restarts. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis, but the availability impact is severe for any network segment relying on the affected switch.
License exhaustion in Juniper Networks Junos OS Evolved lets an unauthenticated, network-based attacker reach the device's license-management process, which was intended to be internal-only but is exposed on an open network port due to incorrect initialization. All Junos OS Evolved releases before 23.2R2-EVO are affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible network-facing denial-of-service risk to affected routing/switching platforms.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a local, low-privileged attacker to crash the l2ald (Layer 2 Address Learning Daemon) by issuing a specific 'show l2-learning' CLI command, disrupting all Layer 2 services until the process automatically restarts. The root cause is a Return of Pointer Value Outside of Expected Range flaw (CWE-466) in the fileio library. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA or the vendor.
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that assigns duplicate index values to new peers, triggering continuous iked process crashes and a full VPN service outage requiring system reboot. Unauthenticated network-based attackers can deliberately flood the device with failing VPN negotiations to accelerate the rollover condition. No public exploit code or CISA KEV listing exists at time of analysis, but the network-reachable, zero-privilege attack vector makes this a meaningful risk for any organization relying on Juniper-based VPN infrastructure with iked enabled.
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes the process when handling crafted network requests, taking down all web-management-dependent services including J-Web, remote-access VPN, and firewall authentication until automatic process recovery. Exploitation is gated on a specific non-default configuration - remote-access VPN with pre-logon compliance check enabled - limiting the exposed population to SRX deployments that actively use this feature. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the official CVSS 5.3 score reflects the limited, reversible availability-only impact.
Junos OS Evolved exposes an internal communication process to the network via an unintended open port due to incorrect initialization, enabling unauthenticated remote attackers to interact with a service never designed for external access. Affected Juniper devices suffer limited information disclosure and elevated CPU consumption as the misbound process handles unsolicited ingress packets - a soft availability degradation rather than a crash. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the unauthenticated network vector across a broad version range warrants prompt patching on internet-facing routing infrastructure.
Junos OS on Juniper EX Series access switches exposes a missing authorization flaw in the CLI that allows any locally authenticated user, regardless of privilege class or assigned permissions, to execute a specific privileged 'request' command and cause complete traffic disruption on the affected switch. Affected platforms span EX2300, EX4000, EX4100, EX4300-MP, and EX4400 across six active Junos OS release trains from 23.2 through 25.4. No public exploit has been identified at time of analysis and the system recovers automatically, but the low barrier to exploitation - any authenticated local user qualifies - makes this a meaningful insider threat in shared-access or multi-tenant switch environments.
Packet forwarding engine (pfe) in Juniper Networks Junos OS on EX4100, EX4400, EX4650, and QFX5120 devices fails to correctly initialize egress filters on IRB and physical interfaces, allowing unauthenticated network-based attackers to bypass security policies and cause integrity impact by forwarding traffic that should be blocked. The vulnerability affects Junos OS versions 23.4R2-S6 and 24.2R2-S3. EPSS score of 6.9 reflects moderate exploitation probability; no active exploitation confirmed (non-KEV status).
Denial of service in Juniper Junos OS chassis control daemon (chassisd) on SRX1600, SRX2300, and SRX4300 devices allows local attackers with low privileges to trigger a complete crash via a specific 'show chassis' CLI command, causing temporary traffic disruption until module recovery. Junos OS 24.4 versions before 24.4R1-S3 and 24.4R2 are affected; no public exploit code identified at time of analysis.
Stored cross-site scripting (XSS) in Juniper Networks Junos Space allows unauthenticated remote attackers to inject malicious script tags into the list filter field, which execute with the permissions of any user who views the affected page, including administrators. All versions before 24.1R5 Patch V3 are vulnerable. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated buffer overflow in Juniper Networks Junos OS Evolved advanced forwarding toolkit (evo-aftmand/evo-pfemand) permits adjacent attackers to crash PTX Series and QFX5000 Series devices via crafted multicast packets. Exploitation triggers line card or device restart, sustaining denial of service under continuous attack. Affects multiple Junos OS Evolved release branches before patched versions. No public exploit identified at time of analysis. Attack requires adjacent network access but no authentication, making exploitation feasible in shared network segments.
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-based line cards running Junos OS Evolved. Missing authentication in critical command processing functions enables authenticated administrators with elevated privileges to bypass access controls and execute commands as root on affected hardware modules including MPC7-11, LC2101/2103, LC480/4800/9600, MX304 built-in FPC, MX-SPC3, SRX5K-SPC3, EX9200-40XS, and PTX-series line cards. No public exploit identified at time of analysis.