CVE-2026-33785
Full vulnerability record from the local CVENow database.
Description
A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices. Any user logged in, without requiring specific privileges, can issue 'request csds' CLI operational commands. These commands are only meant to be executed by high privileged or users designated for Juniper Device Manager (JDM) / Connected Security Distributed Services (CSDS) operations as they will impact all aspects of the devices managed via the respective MX. This issue affects Junos OS on MX Series: * 24.4 releases before 24.4R2-S3, * 25.2 releases before 25.2R2. This issue does not affect Junos OS releases before 24.4.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-09 22:16:27.987000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-33785",
"sourceIdentifier": "[email protected]",
"published": "2026-04-09T22:16:27.987",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute specific commands which will lead to a complete compromise of managed devices.\n\nAny user logged in, without requiring specific privileges, can issue 'request csds' CLI operational commands. These commands are only meant to be executed by high privileged or users designated for Juniper Device Manager (JDM) / Connected Security Distributed Services (CSDS) operations as they will impact all aspects of the devices managed via the respective MX.\n\nThis issue affects Junos OS on MX Series:\n\n\n\n * 24.4 releases before 24.4R2-S3, \n * 25.2 releases before 25.2R2.\n\n\n\n\nThis issue does not affect Junos OS releases before 24.4."
},
{
"lang": "es",
"value": "Una vulnerabilidad de autorización faltante en la CLI de Juniper Networks Junos OS en la serie MX permite a un usuario local, autenticado y con bajos privilegios ejecutar comandos específicos lo que conducirá a un compromiso completo de los dispositivos gestionados.\n\nCualquier usuario que haya iniciado sesión, sin requerir privilegios específicos, puede emitir comandos operativos de la CLI ’request csds’. Estos comandos solo deben ser ejecutados por usuarios con altos privilegios o usuarios designados para operaciones de Juniper Device Manager (JDM) / Connected Security Distributed Services (CSDS) ya que impactarán todos los aspectos de los dispositivos gestionados a través del MX respectivo.\n\nEste problema afecta a Junos OS en la serie MX:\n\n * versiones 24.4 anteriores a 24.4R2-S3,\n * versiones 25.2 anteriores a 25.2R2.\n\nEste problema no afecta a las versiones de Junos OS anteriores a 24.4."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Juniper Networks",
"product": "Junos OS",
"defaultStatus": "unaffected",
"platforms": [
"MX Series"
],
"versions": [
{
"version": "24.4",
"lessThan": "24.4R2-S3",
"versionType": "semver",
"status": "affected"
},
{
"version": "25.2",
"lessThan": "25.2R2",
"versionType": "semver",
"status": "affected"
},
{
"version": "0",
"lessThan": "24.4R1",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "YES",
"Recovery": "USER",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.0,
"impactScore": 6.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-13T00:00:00+00:00",
"id": "CVE-2026-33785",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-862"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*",
"matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*",
"matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*",
"matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*",
"matchCriteriaId": "D74087E2-5CAA-4085-8408-EB70EC1D5D91"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:24.4:r2:*:*:*:*:*:*",
"matchCriteriaId": "0EEF1798-F3C2-4645-96E7-1E82368B184D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s1:*:*:*:*:*:*",
"matchCriteriaId": "C8BB5EE1-04C7-4DF3-807A-06005ECFEEE5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:24.4:r2-s2:*:*:*:*:*:*",
"matchCriteriaId": "4C707226-9C89-4D06-8E8F-2071061E6F2A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*",
"matchCriteriaId": "1B7572BB-9C77-4214-9C5F-CC83C7B93E37"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "CAADBF98-38BE-40E2-AF1B-9077DCED0809"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*",
"matchCriteriaId": "558F0A4C-0C72-4BF1-B2DE-C0D3BFD54BCD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s2:*:*:*:*:*:*",
"matchCriteriaId": "127FE528-AB27-4B18-AF3B-1BE7C0AEEE20"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx10004:-:*:*:*:*:*:*:*",
"matchCriteriaId": "84F7BB7E-3A52-4C23-A4D2-50E75C912AFC"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx10008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D6F0EA2F-BF7E-45D0-B2B4-8A7B67A9475A"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx2008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2FEF33EB-B2E0-42EF-A1BB-D41021B6D08F"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx2010:-:*:*:*:*:*:*:*",
"matchCriteriaId": "27175D9A-CA2C-4218-8042-835E25DFCA43"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx2020:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00C7FC57-8ACF-45AA-A227-7E3B350FD24F"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx204:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2754C2DF-DF6E-4109-9463-38B4E0465B77"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx240:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F4A26704-A6A4-4C4F-9E12-A0A0259491EF"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx301:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D02580FA-1F11-4568-BAFA-C1E0EAF67100"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx304:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3F7FB0CC-624D-4AB9-A7AC-BB19838C3B22"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx480:-:*:*:*:*:*:*:*",
"matchCriteriaId": "104858BD-D31D-40E0-8524-2EC311F10EAC"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:mx960:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B5E08E1E-0FE4-4294-9497-BBFFECA2A220"
}
]
}
]
}
],
"references": [
{
"url": "https://kb.juniper.net/JSA107872",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
}
]
}