The vulnerability is an Improper Neutralization of Special Elements in an OS Command, allowing an attacker to craft a salt minion ID that is passed unescaped to the underlying operating system. When the AutomatedProvisioner processes this value it can execute arbitrary commands as the system root user, giving the attacker full control of the appliance. The vulnerability is exploitable without authentication and is not limited by any user-supplied context other than the presence of a guest or unauthenticated user who can influence the input field.

Juniper Networks Session Smart Conductor appliances running any release before 7.0.5, before 7.1.7, or before 7.2.3 are affected. The fix is provided in release 7.0.5 and all later releases, in release 7.1.7 and all later releases, and in release 7.2.3 and all later releases.

The CVSS score of 9.8 reflects a very high severity, and the EPSS score is currently unavailable, so the exploitation probability cannot be quantified. The vulnerability is not reported in the CISA KEV catalog. Attackers do not need any special credentials; unauthenticated access to the AutomatedProvisioner component is sufficient to conduct the exploit, making the threat surface broad and the potential impact severe.