A stack-based buffer overflow in the authd process of Juniper Networks Junos OS and Junos OS Evolved allows a network attacker who can read SNMP data to execute arbitrary code with root privileges or trigger a denial of service. The flaw arises when both SNMP and AAA services are enabled and can be triggered by a specially crafted SNMP packet. The impact is the compromise of system integrity and availability, potentially giving the attacker full control of the device.

Juniper Networks Junos OS and Junos OS Evolved are affected. The following release lines contain the vulnerability: Junos OS 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1 and all subsequent releases; Junos OS Evolved 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.2X100-D35-EVO, 25.4R1-S3-EVO, 25.4R2-EVO, 25.4X300-D40-EVO, 26.2R1-S2-EVO, 26.2R2-EVO, 26.4R1-EVO and all subsequent releases,

The vulnerability has a CVSS score of 8.7, indicating high severity, and the EPSS score of < 1% indicates a very low but non-zero exploitation probability. It is not listed in the CISA KEV catalog. The attack requires network access to send an SNMP packet to a device with SNMP read privileges and AAA enabled. Successful exploitation can lead to arbitrary code execution with root privileges or a disruptive denial of service.