cbcvebase.
CVE-2024-47495
published 2024-10-11

CVE-2024-47495: An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device…

PriorityP432medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
0.21%
11.0th percentile
An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines (REs) are in use on Juniper Networks Junos OS Evolved devices.

This issue affects:
Juniper Networks Junos OS Evolved with dual-REs:
* All versions before 21.2R3-S8-EVO,
* from 21.4-EVO before 21.4R3-S8-EVO,
* from 22.2-EVO before 22.2R3-S4-EVO,
* from 22.3-EVO before 22.3R3-S4-EVO,
* from 22.4-EVO before 22.4R3-S3-EVO,
* from 23.2-EVO before 23.2R2-S1-EVO,
* from 23.4-EVO before 23.4R2-S1-EVO.


This issue does not affect Juniper Networks Junos OS.

Affected

16 ranges
VendorProductVersion rangeFixed in
juniperjunos_os
juniperjunos_os_evolved< 21.221.2
juniperjunos_os_evolved
juniperjunos_os_evolved
juniperjunos_os_evolved
juniperjunos_os_evolved
juniperjunos_os_evolved
juniperjunos_os_evolved
juniperjunos_os_evolved
juniper_networksjunos_os_evolved< 21.2R3-S8-EVO21.2R3-S8-EVO
juniper_networksjunos_os_evolved>= 21.4-EVO < 21.4R3-S8-EVO21.4R3-S8-EVO
juniper_networksjunos_os_evolved>= 22.2-EVO < 22.2R3-S4-EVO22.2R3-S4-EVO
juniper_networksjunos_os_evolved>= 22.3-EVO < 22.3R3-S4-EVO22.3R3-S4-EVO
juniper_networksjunos_os_evolved>= 22.4-EVO < 22.4R3-S3-EVO22.4R3-S3-EVO
juniper_networksjunos_os_evolved>= 23.2-EVO < 23.2R2-S1-EVO23.2R2-S1-EVO
juniper_networksjunos_os_evolved>= 23.4-EVO < 23.4R2-S1-EVO23.4R2-S1-EVO

CVSS provenance

nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.4HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:C/RE:L/U:Green
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.