Description

An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-14T17:17:56.617Z",
  "pubdate": "2026-10-14T17:17:56.617Z",
  "executiveSummary": "This vulnerability is an OS Command Injection flaw identified within the TACACS+ authentication and authorization module of Juniper Networks Junos OS Evolved.\nThe vulnerability allows a remote, low-privileged user authenticated via TACACS+ to execute arbitrary commands on the underlying operating system with root-level privileges.\nThe issue is specifically triggered when the periodic TACACS+ authorization-refresh mechanism is enabled, creating a window for command injection during the session re-validation process.\nThe risk is critical, as it bypasses standard access control mechanisms, providing an attacker with full control over the affected routing or switching platform.\nExploitation requires the attacker to possess valid low-privileged TACACS+ credentials and the target device must be configured to utilize periodic authorization-refresh, which is a common deployment scenario for continuous security auditing.\nSuccessful exploitation facilitates complete system compromise, allowing attackers to install persistent backdoors, intercept management traffic, or pivot within the administrative network.",
  "technicalDetails": "The vulnerability resides in the interaction between the TACACS+ client implementation within Junos OS Evolved and the subprocess responsible for handling authorization-refresh tasks.\nThe root cause is an improper sanitization of input data retrieved or processed during the periodic authorization-refresh cycle. When the system initiates an authorization request to the configured TACACS+ server, the response payload is parsed by the authentication daemon.\nIf an attacker can influence the response returned by the TACACS+ server—or simulate a malicious response in environments where server-side validation is insufficient—the improperly sanitized fields are passed to a system shell or executive function.\nBecause this specific authorization-refresh logic executes under the context of a highly privileged system process, the injected commands are executed with root privileges.\nThe attack flow follows a structured progression: First, the attacker establishes a valid low-privileged session via TACACS+. Second, the attacker ensures the device is configured with periodic authorization-refresh enabled. Third, the attacker provides a specially crafted input that is intercepted or processed during the background refresh trigger.\nAs the system daemon processes the refreshed authorization metadata, the injected command string is concatenated into a system command execution chain without adequate character escaping or input validation.\nThis behavior results in the execution of the attacker's payload by the operating system's command interpreter (sh/bash).\nGiven that the daemon responsible for these tasks typically requires extensive system-level access to enforce access control lists and user privileges, the resulting code execution inherits these broad permissions.\nThe impact of this vulnerability is total system compromise. An attacker can execute arbitrary shell commands to modify the device configuration, disable security logging, exfiltrate sensitive cryptographic keys, or modify running processes. This is particularly severe in Junos OS Evolved architectures, where the modular nature of the system might otherwise isolate specific services, but the root-level nature of this exploit effectively bypasses those boundaries.\nFurthermore, since the trigger is periodic, the exploit can be staged to execute automatically at set intervals, potentially creating a persistent presence if the attacker maintains control over the associated TACACS+ authorization server responses."
}