Junos OS: unsanitized input in a 'request csds' CLI command gives local users root on the device

Impact

A specific 'request csds' CLI command does not sanitize its argument, so a low-privileged, authenticated operator on a Junos device can have their input interpreted as a command and run it with root privileges. On a datacenter router or firewall that means full control of the box: configuration rewrite, traffic redirection or mirroring across every tenant whose traffic transits it, and a foothold that survives config review because the device itself is now untrusted. Affects Junos OS 24.4 before 24.4R2-S4, 25.2 before 25.2R2-S1 and 25.4 before 25.4R1-S3; releases before 24.4R1 are not affected.

Who can reach it

Local, authenticated low-privileged CLI user on the Junos device - anyone with read-only or limited operator login on the management plane. No network-only path.

What to do

Upgrade to Junos OS 24.4R2-S4, 25.2R2-S1, 25.4R1-S3 or later per Juniper JSA112180. A Junos upgrade reboots the routing engine, so expect a maintenance window per device; on a redundant pair, upgrade and fail over one engine at a time. Until then, trim CLI login accounts and restrict access to the management VLAN and authorized operators.

References

Related entries

• Alias Checking Trusted Module (ACTM) firmware for Intel Xeon processors, including Xeon 6: Improper access controlCVE-2026-20898 · Alias Checking Trusted Module (ACTM) firmware for Intel Xeon processors, including Xeon 6High
• Intel Ethernet Adapter manageability firmware (access control): Improper access control in Intel Ethernet adapterCVE-2021-33162 · Intel Ethernet Adapter manageability firmware (access control)High
• Crypto API Toolkit for Intel SGX: Improper access control in the SGX Crypto API Toolkit lets an authenticated userCVE-2022-21163 · Crypto API Toolkit for Intel SGXHigh
• HPE iLO 5 (local privilege escalation to code execution): An unprivileged user can execute arbitrary code in the iLOCVE-2022-28627 · HPE iLO 5 (local privilege escalation to code execution)High
• Phoenix SecureCore Technology 4 (SMI handler, improper access control): An SMI handler with missing access control letsCVE-2023-31100 · Phoenix SecureCore Technology 4 (SMI handler, improper access control)High
• AMD Secure Processor - XGMI Trusted Agent (type confusion): Type confusion in the ASP's XGMI Trusted Agent means aCVE-2023-31323 · AMD Secure Processor - XGMI Trusted Agent (type confusion)High