CVE-2023-28973 — Improper Authorization in Networks Junos OS Evolved

CWE-285 — Improper AuthorizationCWE-287 — Improper Authentication4 documents4 sources
Severity
7.1HIGHNVD
EPSS
0.0%
top 89.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Junos OS EvolvedJuniper Junos OS Evolved
Timeline
PublishedApr 17
Latest updateApr 18

Description

An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker to execute administrative commands that could impact the integrity of the system or system availability. Administrative functions such as daemon restarting, routing engine (RE) switchover, and node shutdown can all be performed through exploitation of the 'sysmanctl' command. Access to the 'sysmanctl' command is only available from the Junos shell. …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5juniper_networks/junos_os_evolvedunspecified — 20.4R3-S5-EVO+3

🔴Vulnerability Details

2
GHSA
GHSA-qxqf-752w-278r: An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker t↗2023-04-18
▶
CVEList
Junos OS Evolved: The 'sysmanctl' shell command allows a local user to gain access to some administrative actions↗2023-04-17
▶

📋Vendor Advisories

1
Juniper
CVE-2023-28973: An Improper Authorization vulnerability in the 'sysmanctl' shell command of Juniper Networks Junos OS Evolved allows a local, authenticated attacker t↗2023-04-17
▶
CVE-2023-28973 — Improper Authorization | cvebase