The vulnerability is an XML Injection flaw in the Unified Threat Management daemon of Junos OS on SRX Series devices, enabling an unauthenticated network attacker to commit arbitrary configuration changes with root privileges via a malicious response from a configured custom URL‑feed server. This allows the attacker to alter firewall rules, routing policies, or other critical settings, effectively taking full control over the device’s configuration and potentially compromising network security.

Juniper Networks Junos OS SRX Series devices are affected. The issue appears in releases 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 25.4R2, 26.2R1-S2, 26.2R2, 26.4R1, and all subsequent releases. For 23.4 and 24.2, specific respins have been provided to resolve the vulnerability.

Because the vulnerability is an XML Injection flaw, any malicious response from a custom URL‑feed server can be used to commit arbitrary configuration changes. The description implies that an attacker must have network access to the SRX device and control over the URL‑feed source; therefore the likely attack vector is a network-based remote attacker who can host or spoof the URL‑feed server. This inference is drawn from the text, as the parent description does not explicitly state the vector. The EPSS score is < 1%, indicating a very low but non‑zero exploitation probability. The CVSS score of 9.2 reflects critical severity, and the issue is not listed in CISA KEV. The lack of authentication and the network-based nature mean that remote attackers could exploit the flaw from any reachable network segment, assuming they can influence the URL‑feed response.