Junos OS Evolved on PTX: low-privileged local user gains high-privileged direct access to line cards

Impact

A critical function on the Flexible PIC Concentrators of affected PTX10004/10008/10016 chassis is reachable without authentication, so a local user who only has low-privilege CLI access on the router can get a direct, high-privileged session on the installed line cards. Juniper says this can lead to full compromise of the FPC. PTX boxes are the spine and DCI layer in large fleets, so an attacker with line-card-level control sits on the path that carries every tenant's traffic and can mirror, drop or alter it while the control plane still looks healthy. Line-card firmware state also survives a routing-engine reload, which makes cleanup more than a reboot.

Who can reach it

Local, authenticated attacker with low privileges on the router - a read-only or operator account on the Junos OS Evolved CLI is enough. Only PTX10004, PTX10008 and PTX10016 fitted with JNP10K-LC1201 or JNP10K-LC1202 line cards are affected.

What to do

Upgrade to 21.2R3-S8-EVO, 21.4R3-S7-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R3-S2-EVO or 23.2R2-EVO depending on your train. A Junos Evolved upgrade on a PTX reboots the routing engines and the line cards, so this is a chassis maintenance window - schedule it per device and lean on redundant paths rather than attempting it in place. Until then, tighten who holds any login on these chassis, since the flaw needs only a low-privileged local account.

References

Related entries

• Junos OS: unsigned Python op scripts let a low-privileged user execute as rootCVE-2026-33793 · Juniper Junos OS / Junos OS Evolved CLI (unsigned Python op scripts)High
• Intel Ethernet Adapter manageability firmware (access control): Improper access control in Intel Ethernet adapterCVE-2021-33162 · Intel Ethernet Adapter manageability firmware (access control)High
• Crypto API Toolkit for Intel SGX: Improper access control in the SGX Crypto API Toolkit lets an authenticated userCVE-2022-21163 · Crypto API Toolkit for Intel SGXHigh
• HPE iLO 5 (local privilege escalation to code execution): An unprivileged user can execute arbitrary code in the iLOCVE-2022-28627 · HPE iLO 5 (local privilege escalation to code execution)High
• Phoenix SecureCore Technology 4 (SMI handler, improper access control): An SMI handler with missing access control letsCVE-2023-31100 · Phoenix SecureCore Technology 4 (SMI handler, improper access control)High
• AMD Secure Processor - XGMI Trusted Agent (type confusion): Type confusion in the ASP's XGMI Trusted Agent means aCVE-2023-31323 · AMD Secure Processor - XGMI Trusted Agent (type confusion)High