The vulnerability is an OS Command Injection in the bootzd zero‑touch provisioning daemon of Juniper Networks Junos OS Evolved on PTX Series, enabling an unauthenticated attacker on the management LAN to execute arbitrary commands with root privileges via a crafted gRPC response. The weakness corresponds to CWE‑78 and can lead to full system compromise if exploited.

Vendors: Juniper Networks; Product: Junos OS Evolved, PTX Series. Affected releases are 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO, and all subsequent releases. Earlier releases of 23.2‑EVO, 23.4‑EVO, and 24.2‑EVO have specific respins that also contain the fix.

With a CVSS score of 8.7, this flaw is considered high severity. The EPSS score of 4% signals a moderate likelihood of exploitation. The vulnerability is not recorded in the CISA KEV catalog, but it enables unauthenticated root‑level command execution during zero‑touch provisioning over the device’s management LAN, a critical threat. Based on the description, it is inferred that the likely attack vector is a local network connection to the device’s management interface when zero‑touch provisioning is enabled; no authentication is required to trigger the flaw.