The vulnerability involves an improper neutralization of special elements in the phone‑home daemon (phcd), a form of OS Command Injection (CWE‑78), allowing an adjacent attacker to inject operating system commands that are executed with root privileges. This can result in arbitrary code execution on the device, compromising confidentiality, integrity, and availability of the system and potentially the entire network it serves.

The issue affects Juniper Networks Junos OS and Junos OS Evolved firmware on EX Series, SRX Series, and QFX Series devices. Versions impacted include all Junos OS releases 23.2R2‑S7.7, 23.4R2‑S8.13, 24.2R2‑S5.5, 24.4R2‑S5, 25.2R2‑S2, 25.4R1‑S3, 25.4R2, 26.2R1‑S2, 26.2R2, 26.4R1 and subsequent builds; and Junos OS Evolved releases 23.2R2‑S7.7‑EVO, 23.4R2‑S8.11‑EVO, 24.2R2‑S5.6‑EVO, 24.4R2‑S5‑EVO, 25.2R2‑S2‑EVO, 25.2X100‑D35‑EVO, 25.4R1‑S3‑EVO, 25.4R2‑EVO, 25.4X300‑D40‑EVO, 26.2R1‑S2‑EVO, 26.2R2‑EVO, 26.4R1‑EVO and later builds.

The CVSS score of 8.7 reflects a high severity vulnerability. EPSS score is 4%, indicating a moderate exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an adjacent device on the same network segment can act as a rogue DHCP server to supply specially crafted options that are parsed by the phone‑home client. If such a packet reaches the device, the vulnerable phcd will execute the attacker’s payload with root privileges. No official workaround exists; the only mitigation is to update to a fixed firmware release.