Description

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web HTTP or HTTPS service when web management is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T18:17:11.277Z",
  "pubdate": "2026-10-14T18:17:11.277Z",
  "executiveSummary": "An improper authentication vulnerability exists within the J-Web management interface and NETCONF session handling mechanisms of Juniper Networks Junos OS and Junos OS Evolved.\nThe vulnerability allows an unauthenticated, remote network attacker to bypass standard security controls, effectively gaining root-level privileges over the device configuration.\nThis flaw resides in the handling of HTTP/HTTPS requests processed by the J-Web service, provided that the web management interface is enabled on the device.\nSuccessful exploitation results in full administrative control, enabling the attacker to modify device configurations, intercept traffic, or perform arbitrary administrative actions without prior authentication.\nGiven the nature of the vulnerability, the risk is classified as critical, as it bypasses the primary perimeter defense for device management.\nAttackers can leverage this access to establish persistent persistence, disable logging, or exfiltrate sensitive network data.\nExposure is limited to devices where the J-Web management service is active and reachable over the network.",
  "technicalDetails": "The vulnerability originates from a flaw in the authentication validation logic within the J-Web and NETCONF integration layers of Junos OS and Junos OS Evolved. Specifically, the affected components fail to properly verify authentication tokens or session states when processing specific types of HTTP/HTTPS requests intended for configuration management.\nThe root cause is identified as an Improper Authentication flaw where the J-Web service improperly handles session initialization or verification when interacting with the underlying NETCONF management subsystem. When an attacker sends specially crafted requests to the J-Web interface, the service may incorrectly process these requests as authenticated sessions, bypassing the standard login procedure.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies a target Juniper device with the J-Web service exposed on the network. The attacker sends a crafted HTTP or HTTPS request designed to trigger the flawed session handling mechanism. The J-Web process, failing to enforce authentication requirements, passes the request to the NETCONF daemon with elevated or root-level permissions.\nBecause the NETCONF interface acts as an administrative backend for the device, the injection of malicious or unauthorized configuration commands at this layer allows the attacker to achieve total system compromise. The attacker can execute commands that modify the root filesystem, alter routing tables, change firewall policies, or modify administrative user accounts.\nExploitation does not require valid credentials, and the attacker does not need to bypass traditional user-space authentication because the logic flaw exists at the protocol interpretation level between J-Web and the management subsystem.\nPost-exploitation impact is severe, as the attacker achieves root-level device configuration access. This level of access grants the capability to dump configuration files containing sensitive data, such as hashed passwords, keys, or pre-shared secrets, effectively allowing the attacker to persist indefinitely or pivot into the internal network protected by the Juniper device."
}