CVE-2022-22221

published 2022-07-20

CVE-2022-22221: An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally…

Priority P3 43 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally authenticated attacker with low privileges to take full control over the device. One aspect of this vulnerability is that the attacker needs to be able to execute any of the "request ..." or "show system download ..." commands. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: All versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2, 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R2-S2, 21.2R3; 21.3 versions prior to 21.3R2, 21.3R3; 21.4 versions prior to 21.4R1-S1, 21.4R2.

Affected

27 ranges · showing 25

Vendor	Product	Version range	Fixed in
juniper	ex_series	—	—
juniper	junos	< 19.2	19.2
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper	srx_series	—	—
juniper_networks	junos_os	>= 19.2 < 19.2R1-S9, 19.2R3-S5	19.2R1-S9, 19.2R3-S5
juniper_networks	junos_os	>= 19.3 < 19.3R3-S6	19.3R3-S6
juniper_networks	junos_os	>= 19.4 < 19.4R3-S8	19.4R3-S8
juniper_networks	junos_os	>= 20.1 < 20.1R3-S4	20.1R3-S4
juniper_networks	junos_os	>= 20.2 < 20.2R3-S4	20.2R3-S4
juniper_networks	junos_os	>= 20.3 < 20.3R3-S3	20.3R3-S3
juniper_networks	junos_os	>= 20.4 < 20.4R3-S2, 20.4R3-S3	20.4R3-S2, 20.4R3-S3
juniper_networks	junos_os	>= 21.1 < 21.1R3-S1	21.1R3-S1
juniper_networks	junos_os	>= 21.2 < 21.2R2-S2, 21.2R3	21.2R2-S2, 21.2R3
juniper_networks	junos_os	>= 21.3 < 21.3R2, 21.3R3	21.3R2, 21.3R3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.