Vulnerability · Published Jan 15, 2021 · Assigned by juniper
CVE-2021-0219Junos OS: Command injection vulnerability in 'request system software' CLI command
Medium 6.7
In plain English
A medium-severity OS command injection in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a locally authenticated attacker with privileges to execute commands with root privilege. To validate a package in Junos before installation, an administrator executes the command 'request system software add validate-on-host' via the CLI. An attacker with access to this CLI command may be able to exploit this vulnerability. This issue affects Juniper Networks Junos OS: all versions prior to 17.3R3-S10; 17.4 versions prior to 17.4R2-S12, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R2-S8, 18.2R3-S6; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8, 18.4R2-S7, 18.4R3-S6; 19.1 versions prior to 19.1R1-S6, 19.1R2-S2, 19.1R3-S3; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R2-S5, 19.3R3-S1; 19.4 versions prior to 19.4R2-S2, 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S2, 20.2R2; 20.3 versions prior to 20.3R1-S1, 20.3R2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | unspecified – before 17.3R3-S1017.4 – before 17.4R2-S12, 17.4R3-S318.1 – before 18.1R3-S1118.2 – before 18.2R2-S8, 18.2R3-S618.3 – before 18.3R3-S418.4 – before 18.4R1-S8, 18.4R2-S7, 18.4R3-S619.1 – before 19.1R1-S6, 19.1R2-S2, 19.1R3-S319.2 – before 19.2R3-S1 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://kb.juniper.net/JSA11109 x_refsource_CONFIRM