OS Command Injection in Juniper Junos OS and Junos OS Evolved

Executive Summary

This is an OS Command Injection vulnerability in Juniper Networks Junos OS and Junos OS Evolved. It exists in the phone-home daemon (phcd) on EX Series, SRX Series, and QFX Series devices. An adjacent unauthenticated attacker can exploit it by sending malicious commands via a rogue DHCP server, allowing them to execute arbitrary commands with root privileges.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for rogue DHCP servers and inspecting phcd logs. Check for unexpected commands executed by phcd or unusual network traffic patterns. Juniper recommends reviewing DHCP server logs and using network monitoring tools to identify unauthorized DHCP responses.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control of affected Juniper devices, leading to potential data breaches, network compromise, or disruption of services. Since the attack comes from an adjacent network, it may be exploited without direct internet access to the device.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data exfiltration, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Juniper devices may face compliance violations, fines, or legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Junos OS and Junos OS Evolved on EX Series, SRX Series, and QFX Series to the latest patched versions to address the OS command injection vulnerability in the phone-home daemon (phcd). Disable the phcd service if not required and monitor network traffic for rogue DHCP servers.

Useful 0 Not Useful 0