Juniper Junos OS / Junos OS Evolved (annotate configuration command): The `annotate` configuration command can be used

Impact

The annotate configuration command can be used to escalate privileges. A user with limited configuration rights — the sort of account you give an automation system or a junior operator — gains more than their class allows on a device that may be a spine. Junos login classes are the mechanism most Juniper shops use for internal separation of duties, and this puts a hole in it.

Who can reach it

Authenticated low-privileged user with configuration access to the device.

What to do

Junos upgrade plus reboot. Interim: restrict the annotate command in affected login classes via the allow-/deny-commands regex — a live config change that closes it without a maintenance window.

References

Related entries

• Juniper Junos OS (QFX5000-Series, EX4600-Series): A physical-access path into affected QFX5000 and EX4600 switchesCVE-2025-59957 · Juniper Junos OS (QFX5000-Series, EX4600-Series)Unscored
• Juniper Junos OS Evolved (QFX5000 / PTX, multicast packet handling): Crafted multicast packets crash and restartCVE-2025-59969 · Juniper Junos OS Evolved (QFX5000 / PTX, multicast packet handling)Unscored
• ASPEED crypto/ACRY accelerator driver (drivers/crypto/aspeed): The ACRY driver's probe error path and its remove pathCVE-2025-68172 · ASPEED crypto/ACRY accelerator driver (drivers/crypto/aspeed)Unscored
• Linux kernel mlx5_core firmware tracer (diag/fw_tracer): The firmware tracer took format strings directly from deviceCVE-2025-68816 · Linux kernel mlx5_core firmware tracer (diag/fw_tracer)Unscored
• Gigabyte UEFI firmware (SMM, unchecked RBX pointer): An attacker-controlled register is used as an unchecked pointerCVE-2025-7026 · Gigabyte UEFI firmware (SMM, unchecked RBX pointer)Unscored
• Gigabyte UEFI firmware (SMM, NVRAM double pointer dereference): An unvalidated NVRAM variable is dereferenced twiceCVE-2025-7027 · Gigabyte UEFI firmware (SMM, NVRAM double pointer dereference)Unscored