CVE-2021-0278 Junos OS: J-Web allows a locally authenticated attacker to escalate their privileges to root.

High 8.8 Published 15 Jul 2021 Updated 17 Sep 2024

A locally authenticated attacker can escalate privileges to root on Juniper Junos OS devices via improper input validation in J-Web.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-0278?

CVE-2021-0278 is a high-severity vulnerability in Juniper Junos, published on 15 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated attacker to escalate their privileges to root over the target device. junos:18.3R3-S5 junos:18.4R3-S9 junos:19.1R3-S6 junos:19.3R2-S6 junos:19.3R3-S3 junos:19.4R1-S4 junos:19.4R3-S4 junos:20.1R2-S2 junos:20.1R3 junos:20.2R3-S1 junos:20.3X75-D20 junos:20.3X75-D30 junos:20.4R2-S1 junos:20.4R3 junos:21.1R1-S1 junos:21.1R2 junos:21.2R1 junos:21.3R1 This issue affects: Juniper Networks Junos OS 19.3 versions 19.3R1 and above prior to 19.3R2-S6, 19.3R3-S3; 19.4 versions prior to 19.4R3-S5; 20.1 versions prior to 20.1R2-S2, 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 19.3R1.

Weakness: CWE-20

Which versions are affected by CVE-2021-0278?

It affects 1 product.

Products include Juniper Junos.

How do I fix CVE-2021-0278?

No fix has been published for CVE-2021-0278 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-0278 being exploited?

There is no known exploitation of CVE-2021-0278 in the wild and no public exploit code.

All Juniper Junos vulnerabilities

Sources

Also known as GHSA-phqq-qjp3-jr9q.