A local user with low privileges can run the CLI command 'show mgd' against Juniper Networks Junos OS or Junos OS Evolved, bypassing required authorization checks. This missing authorization flaw allows the extraction of sensitive configuration data and operational information that should only be accessible to privileged accounts. The vulnerability is classified as Information Disclosure due to CWE-862, which identifies missing authorization.

Systems running Junos OS versions older than 22.4R3-S8, all pre-23.2R2-S6 releases, pre-23.4R2-S6, pre-24.2R2-S4, pre-24.4R2-S1, and early 25.2 (before 25.2R1-S2 and 25.2R2) are impacted. Similarly, Junos OS Evolved versions older than 23.2R2-S6-EVO, 23.4R2-S6-EVO, 24.2R2-S4-EVO, 24.4R2-S1-EVO, and 25.2R2-EVO are vulnerable. All newer releases listed in the vendor’s advisory contain the patch and are not affected.

The CVSS base score of 6.8 indicates a medium severity, and the absence of an EPSS score or KEV listing suggests limited current exploitation activity. Exploitation requires the attacker already have local CLI or SSH access with a low-privileged account, which is typical for administrators or service accounts, potentially allowing an insider or compromised credential holder to read confidential data. Administrators should treat this flaw as a moderate to high risk depending on the sensitivity of stored information and apply the recommended patches promptly.