Junos OS: OS command injection in CLI via 'request csds' command

Summary

An OS command injection vulnerability in the Junos OS CLI allows a local attacker with low privileges to run commands with root privileges, which can lead to full device compromise. The flaw lies in the 'request csds' command, which does not sanitize user input. The attacker needs a valid CLI login first, so the main risk comes from compromised or malicious accounts with CLI access. The advisory title names MX Series, but the description does not restrict the issue to MX, so the scope must be confirmed on the vendor advisory.

Affected

• Junos OS 24.4 before 24.4R2-S4
• Junos OS 25.2 before 25.2R2-S1
• Junos OS 25.4 before 25.4R1-S3
• Releases before 24.4R1 are not affected.
• Scope: the advisory title mentions MX Series; confirm on JSA112180 which platforms are affected.

Fixed in

• Junos OS 24.4R2-S4
• Junos OS 25.2R2-S1
• Junos OS 25.4R1-S3
• Junos OS 26.2R1 and all subsequent releases

Confirm the exact builds on JSA112180 before rollout.

Workaround

• Use CLI authorization to disallow execution of the 'request csds' commands for non-admin accounts.
• Restrict CLI and management access to trusted hosts and administrators with access lists or firewall filters.

Exploitation

• Juniper SIRT is not aware of any malicious exploitation.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No public proof of concept was found in the research. The CISA KEV catalog was not checked.

Our recommendation

• Check whether any Junos devices run 24.4, 25.2 or 25.4 builds below the fixed versions.
• Patch affected devices to the fixed versions listed in JSA112180.
• If patching is delayed, apply CLI authorization to block 'request csds' for non-admin accounts.
• Review who holds CLI accounts and remove unneeded accounts, especially for contractors and helpdesk staff.
• Check whether SSH or management interfaces are reachable from the internet and restrict them.
• Monitor logs for unusual 'request' commands.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Juniper Security Advisory JSA112180 supportportal.juniper.net
• OpenCVE: CVE-2026-102079 app.opencve.io
• Positive Technologies record PT-2026-113915 vulners.com
• Tenable plugin issue 233835 www.tenable.com
• Strix: CVE-2026-102079 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:33.