CVE-2026-102079: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Juniper Networks Junos OS

An OS command injection vulnerability exists in the Junos OS CLI due to improper neutralization of special elements in the 'request csds' command. This allows a local attacker with low privileges to execute arbitrary OS commands with root privileges. The flaw arises because user input is not sanitized correctly, enabling unintended command execution. Affected versions include 24.4 prior to 24.4R2-S4, 25.2 prior to 25.2R2-S1, and 25.4 prior to 25.4R1-S3. Juniper Networks has published patches for these versions to address the vulnerability. The CVSS score of 7.8 reflects the high impact on confidentiality, integrity, and availability.

Successful exploitation allows a local, low-privileged attacker to gain root-level control over the affected Junos OS device. This can result in unauthorized system access, modification of system files, and potentially full compromise of the device. The vulnerability impacts confidentiality, integrity, and availability of the system.

A patch is available from Juniper Networks to remediate this vulnerability. Users should apply the official fixes for their respective Junos OS versions: 24.4R2-S4 or later, 25.2R2-S1 or later, and 25.4R1-S3 or later. Since this is a local privilege escalation via CLI command injection, restricting local access and applying the patch are the primary mitigations. Check the Juniper Networks advisory for the exact patch details and deployment instructions.