RCE in Juniper Junos Space
CVE-2024-39563
A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the web application, gaining complete control of the device. A specific script in the Junos Space web application allows attacker-controlled input from a GET request without sufficient input sanitization. A specially crafted request can exploit this vulnerability to execute arbitrary shell commands on the Junos Space Appliance. This issue affects Junos Space 24.1R1. Previous versions of Junos Space are unaffected by this vulnerability.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.013 (68.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Juniper Junos_space — versions 24.1
- Juniper Networks Junos Space — versions 24.1R1
Weakness classification (CWE)
References
- sirt@juniper.net (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-39563?
- CVE-2024-39563 is a high-severity vulnerability in Juniper Junos Space, classified under Command Injection. CVSS score: 7.3/10. Published 2024-10-11.
- How severe is CVE-2024-39563?
- High severity. CVSS v3 base score is 7.3 out of 10.