Metrics
No CVSS v4.0
Attack Vector Local
Attack Complexity Low
Privileges Required Low
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
User Interaction None
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
The EPSS score is 0.00084.
Key SSVC decision points have not yet been added.
Affected Vendors & Products
| Vendors | Products |
|---|---|
|
Juniper
Subscribe
|
Ex2200
Subscribe
Ex2200-c
Subscribe
Ex2200-vc
Subscribe
Ex2300
Subscribe
Ex2300-c
Subscribe
Ex2300m
Subscribe
Ex3200
Subscribe
Ex3300
Subscribe
Ex3300-vc
Subscribe
Ex3400
Subscribe
Ex4200
Subscribe
Ex4200-vc
Subscribe
Ex4300
Subscribe
Ex4300-24p
Subscribe
Ex4300-24p-s
Subscribe
Ex4300-24t
Subscribe
Ex4300-24t-s
Subscribe
Ex4300-32f
Subscribe
Ex4300-32f-dc
Subscribe
Ex4300-32f-s
Subscribe
Ex4300-48mp
Subscribe
Ex4300-48mp-s
Subscribe
Ex4300-48p
Subscribe
Ex4300-48p-s
Subscribe
Ex4300-48t
Subscribe
Ex4300-48t-afi
Subscribe
Ex4300-48t-dc
Subscribe
Ex4300-48t-dc-afi
Subscribe
Ex4300-48t-s
Subscribe
Ex4300-48tafi
Subscribe
Ex4300-48tdc
Subscribe
Ex4300-48tdc-afi
Subscribe
Ex4300-mp
Subscribe
Ex4300-vc
Subscribe
Ex4300m
Subscribe
Ex4400
Subscribe
Ex4500
Subscribe
Ex4500-vc
Subscribe
Ex4550
Subscribe
Ex4550-vc
Subscribe
Ex4550\/vc
Subscribe
Ex4600
Subscribe
Ex4600-vc
Subscribe
Ex4650
Subscribe
Ex6200
Subscribe
Ex6210
Subscribe
Ex8200
Subscribe
Ex8200-vc
Subscribe
Ex8208
Subscribe
Ex8216
Subscribe
Ex9200
Subscribe
Ex9204
Subscribe
Ex9208
Subscribe
Ex9214
Subscribe
Ex9250
Subscribe
Ex9251
Subscribe
Ex9253
Subscribe
Ex Redundant Power System
Subscribe
Junos
Subscribe
Srx100
Subscribe
Srx110
Subscribe
Srx1400
Subscribe
Srx1500
Subscribe
Srx210
Subscribe
Srx220
Subscribe
Srx240
Subscribe
Srx240h2
Subscribe
Srx300
Subscribe
Srx320
Subscribe
Srx340
Subscribe
Srx3400
Subscribe
Srx345
Subscribe
Srx3600
Subscribe
Srx380
Subscribe
Srx4000
Subscribe
Srx4100
Subscribe
Srx4200
Subscribe
Srx4600
Subscribe
Srx5000
Subscribe
Srx5400
Subscribe
Srx550
Subscribe
Srx550 Hm
Subscribe
Srx550m
Subscribe
Srx5600
Subscribe
Srx5800
Subscribe
Srx650
Subscribe
|
Configuration 1 [-]
| AND |
|
No data.
No data.
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2022-27368 | An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally authenticated attacker with low privileges to take full control over the device. One aspect of this vulnerability is that the attacker needs to be able to execute any of the "request ..." or "show system download ..." commands. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: All versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2, 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R2-S2, 21.2R3; 21.3 versions prior to 21.3R2, 21.3R3; 21.4 versions prior to 21.4R1-S1, 21.4R2. |
Solution
The following software releases have been updated to resolve this specific issue: 19.1R3-S9, 19.2R1-S9, 19.2R3-S5, 19.4R3-S8, 20.2R3-S4, 20.3R3-S3, 20.4R3-S2, 20.4R3-S3, 21.1R3-S1, 21.2R2-S2, 21.2R3, 21.3R2, 21.3R3, 21.4R1-S1, 21.4R2, 22.1R1, and all subsequent releases.
Workaround
A workaround would be to deny users access to the "request system download ..." and "show system download ..." CLI commands.
| Link | Providers |
|---|---|
| https://kb.juniper.net/JSA69725 |
|
No history.
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: juniper
Published:
Updated: 2024-09-17T00:15:46.928Z
Reserved: 2021-12-21T00:00:00
Link: CVE-2022-22221
No data.
Status : Modified
Published: 2022-07-20T15:15:09.123
Modified: 2024-11-21T06:46:25.550
Link: CVE-2022-22221
No data.
OpenCVE Enrichment
No data.
EUVD