CVE-2023-28983 Junos OS Evolved: Shell Injection vulnerability in the gNOI server

What is CVE-2023-28983?

CVE-2023-28983 is a high-severity command injection vulnerability in Juniper Junos Os Evolved, published on 17 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An OS Command Injection vulnerability in gRPC Network Operations Interface (gNOI) server module of Juniper Networks Junos OS Evolved allows an authenticated, low privileged, network based attacker to inject shell commands and execute code. This issue affects Juniper Networks Junos OS Evolved 21.4 version 21.4R1-EVO and later versions prior to 22.1R1-EVO.

Weakness: CWE-78

Which versions are affected by CVE-2023-28983?

It affects 1 product.

Products include Juniper Junos Os Evolved.

How do I fix CVE-2023-28983?

No fix has been published for CVE-2023-28983 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-28983 being exploited?

There is no known exploitation of CVE-2023-28983 in the wild and no public exploit code.

Other vulnerabilities in Juniper Junos Os Evolved

• CVE-2026-21902 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root Critical 9.3
• CVE-2025-21599 Denial of service in Junos OS Evolved High 8.7
• CVE-2024-47502 Junos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoS High 8.7
• CVE-2024-39531 Junos OS Evolved: ACX 7000 Series: Protocol specific DDoS configuration affects other protocols High 8.7
• CVE-2024-39562 Junos OS Evolved: A high rate of SSH connections causes a Denial of Service High 8.7

All Juniper Junos Os Evolved vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g3qx-fhf5-4m26.