TI-2026-74287 Aliases CVE-2026-102079

Junos OS command injection through the 'request csds' CLI command

MEDIUM 40CWE-78Published 2026-10-14 · Updated 2026-10-15

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Juniper Networks Junos OS from 24.4 before 24.4R2-S4, from 25.2 before 25.2R2-S1, and from 25.4 before 25.4R1-S3 is affected. A specific 'request csds' command does not sanitize user-provided input, which is an OS command injection flaw (CWE-78). A local attacker with low privileges can run unintended commands with root privileges and take complete control of the device, with unauthorized access to or modification of the system.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

An OS command injection vulnerability in the CLI of Juniper Networks Junos OS allows a local, low privileged attacker to take complete control of the device. A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command. This allows unintended command execution with root privileges, which can lead to unauthorized system access or modification. This issue affects Junos OS: * 24.4 versions before 24.4R2-S4; * 25.2 versions before 25.2R2-S1; * 25.4 versions before 25.4R1-S3; This issue does not affect Junos OS releases before 24.4R1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00659 51st percentileScored 2026-11-07

Fix Fixed Junos OS (Juniper Networks): 24.4R2-S4, 25.2R2-S1, 25.4R1-S3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Juniper	Junos OS	24.4 to before 24.4R2-S4; 25.2 to before 25.2R2-S1; 25.4 to before 25.4R1-S3	24.4R2-S4, 25.2R2-S1, 25.4R1-S3	Patch available	CNA

Junos OS VendorJuniper Affected 24.4 to before 24.4R2-S4; 25.2 to before 25.2R2-S1; 25.4 to before 25.4R1-S3 Fixed in 24.4R2-S4, 25.2R2-S1, 25.4R1-S3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:o:juniper:junos::::::::	—	—	Juniper

cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* Versions — — ·Juniper

Remediation

Upgrade Junos OS to 24.4R2-S4, 25.2R2-S1, or 25.4R1-S3 or later. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Junos OS (Juniper Networks) Fixed in 24.4R2-S4, 25.2R2-S1, 25.4R1-S3

Timeline

2026-10-15 Threatist record created from CVE-2026-102079
2026-10-15 CISA SSVC decision points changed
2026-10-16 Priority changed: LOW → MEDIUM

References

Advisory 1

https://supportportal.juniper.net/JSA112180

TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
TI-2015-06436 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before… KEVCVSS 3.1CRITICAL 9.8
TI-2022-20885 Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults CVSS 3.1CRITICAL 9.8
TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7

See all 1284 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences