CVE-2022-22248

published 2022-10-18

CVE-2022-22248: An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local user to modify the…

Priority P3 39 high 7.3 CVSS 3.1

AV L AC L PR L UI R S U C H I H A H

An Incorrect Permission Assignment vulnerability in shell processing of Juniper Networks Junos OS Evolved allows a low-privileged local user to modify the contents of a configuration file which could cause another user to execute arbitrary commands within the context of the follow-on user's session. If the follow-on user is a high-privileged administrator, the attacker could leverage this vulnerability to take complete control of the target system. While this issue is triggered by a user, other than the attacker, accessing the Junos shell, an attacker simply requires Junos CLI access to exploit this vulnerability. This issue affects Juniper Networks Junos OS Evolved: 20.4-EVO versions prior to 20.4R3-S1-EVO; All versions of 21.1-EVO; 21.2-EVO versions prior to 21.2R3-EVO; 21.3-EVO versions prior to 21.3R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions prior to 19.2R1-EVO.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
juniper	junos_os	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper	junos_os_evolved	—	—
juniper_networks	junos_os_evolved	>= 20.4-EVO < 20.4R3-S1-EVO	20.4R3-S1-EVO
juniper_networks	junos_os_evolved	>= 21.1R1-EVO < 21.1-EVO*	21.1-EVO*
juniper_networks	junos_os_evolved	>= 21.2-EVO < 21.2R3-EVO	21.2R3-EVO
juniper_networks	junos_os_evolved	>= 21.3-EVO < 21.3R2-EVO	21.3R2-EVO

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-732