Junos OS CLI: crafted 'set system' arguments inject shell commands as root

CVSS 8.4CVE-2026-33791Firmware, BMC & network fabriccurated

Impact

Certain set system CLI commands do not sanitize their arguments, so an already-privileged operator session can break out of the CLI and run arbitrary shell commands as root on the routing engine. On a datacenter switch or router this converts configuration-level access into full control of the device: an attacker can persist outside the configuration database, read all keys and credentials stored on the box, and tamper with forwarding or ACLs that separate tenants. Because the exposure is through the normal admin CLI, it also defeats the usual assumption that a restricted-but-privileged operator cannot reach the underlying OS. Juniper rates it 8.4 with local vector and high privileges required.

Who can reach it

Local, authenticated, high-privileged CLI user on the device (console, SSH or management access with configuration rights). No remote unauthenticated path is described.

What to do

Upgrade to a fixed release: Junos OS 22.4R3-S8, 23.2R2-S5, 23.4R2-S7, 24.2R2-S2, 24.4R2, 25.2R2 (or the matching -EVO builds, 25.2R1-S1-EVO / 25.2R2-EVO). That means a maintenance window per device - a Junos upgrade reboots the routing engine, so plan it per fabric element and drain redundant paths first. Until then, restrict configuration-level accounts and audit set system usage.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-33791 https://supportportal.juniper.net/JSA107875

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.