title: Junos OS: buffer overflow vulnerability in Junos CLI
description: A buffer overflow vulnerability in Junos OS CLI may allow a local authenticated user with read only privileges and access to Junos CLI, to execute code with root privileges. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D46 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 14.1X53 versions prior to 14.1X53-D130 on QFabric System; 14.2 versions prior to 14.2R4-S9, 14.2R6; 15.1 versions prior to 15.1F5, 15.1R3; 15.1X49 versions prior to 15.1X49-D40 on SRX Series; 15.1X53 versions prior to 15.1X53-D47 on NFX150, NFX250; 15.1X53 versions prior to 15.1X53-D65 on QFX10000 Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5110, QFX5200.
problem types: buffer overflow in Junos CLI
affected:
{
platforms: EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100;
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 14.1X53-D46, status: affected, version: 14.1X53, versionType: custom
}
{
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 14.2R4-S9, 14.2R6, status: affected, version: 14.2, versionType: custom
lessThan: 15.1F5, 15.1R3, status: affected, version: 15.1, versionType: custom
}
{
platforms: SRX Series
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 15.1X49-D40, status: affected, version: 15.1X49, versionType: custom
}
{
platforms: NFX150, NFX250
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 15.1X53-D47, status: affected, version: 15.1X53, versionType: custom
}
{
platforms: QFX10000 Series
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 15.1X53-D65, status: affected, version: 15.1X53, versionType: custom
}
{
platforms: QFabric System
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 14.1X53-D130, status: affected, version: 14.1X53, versionType: custom
}
{
platforms: QFX5110, QFX5200
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 15.1X53-D233, status: affected, version: 15.1X53, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]
exploits: This issue was found during internal product security testing.  Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: 14.1X53-D46, 14.1X53-D130*, 14.2R4-S9, 14.2R6, 15.1F5, 15.1R3, 15.1X49-D40, 15.1X53-D47, 15.1X53-D65, 15.1X53-D233 16.1R1, and all subsequent releases.
*Pending Publication
This issue is being tracked as PR 1149652 and is visible on the Customer Support website.
workarounds: Use access lists or firewall filters to limit access to the router's CLI only from trusted hosts. Restrict access to the CLI to only highly trusted administrators.