This vulnerability (CWE-862) in Juniper Networks Junos OS and Junos OS Evolved involves missing authorization checks in the CLI command 'show mgd'. A local user with low privileges can exploit this to access sensitive information that should be restricted. Affected versions include all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S6, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S1, and 25.2 versions before 25.2R1-S2 and 25.2R2 for Junos OS, as well as corresponding versions for Junos OS Evolved. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicating local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

A local user with low privileges can read sensitive information by exploiting this missing authorization vulnerability. The confidentiality of sensitive data is compromised, but there is no impact on integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description lists fixed versions, so upgrading to the specified patched versions of Junos OS or Junos OS Evolved is recommended once vendor advisories confirm availability. Until then, restrict local access to trusted users only to mitigate risk.