CVE-2018-0024 — Junos OS: A privilege escalation vulnerability exists where authenticated users with shell access can become root

Back Back to CVE browser

HIGH

Junos OS: A privilege escalation vulnerability exists where authenticated users with shell access can become root

Published Jul 11, 2018

7.8

HIGH

CVSS 3.0

EPSS 0.38%

Description

An Improper Privilege Management vulnerability in a shell session of Juniper Networks Junos OS allows an authenticated unprivileged attacker to gain full control of the system. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D45 on SRX Series; 12.3X48 versions prior to 12.3X48-D20 on SRX Series; 12.3 versions prior to 12.3R11 on EX Series; 14.1X53 versions prior to 14.1X53-D30 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100;; 15.1X49 versions prior to 15.1X49-D20 on SRX Series.

Affected products

Vendor Juniper Networks Product Junos OS Default
n/a
- Version
  12.1X46
  Status
  affected
  Constraints
  <12.1X46-D45
- Version
  12.3
  Status
  affected
  Constraints
  <12.3R11
- Version
  12.3X48
  Status
  affected
  Constraints
  <12.3X48-D20
- Version
  14.1X53
  Status
  affected
  Constraints
  <14.1X53-D30
- Version
  15.1X49
  Status
  affected
  Constraints
  <15.1X49-D20

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Juniper Networks

Junos OS

n/a

Version	Status	Constraints
12.1X46	affected	<12.1X46-D45
12.3	affected	<12.3R11
12.3X48	affected	<12.3X48-D20
14.1X53	affected	<14.1X53-D30
15.1X49	affected	<15.1X49-D20

Remediation

Vendor solution

The following software releases have been updated to resolve this specific issue: Junos OS 12.1X46-D45, 12.3X48-D20, 12.3R11, 14.1X53-D30, 15.1X49-D20 and all subsequent releases.

Metrics

0.38% 0.00378

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00378

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.38% (0.00378)	29.43th	v5 (v2026.06.15)
Sep 20, 2026	0.38% (0.00378)	31.65th	v5 (v2026.06.15)
Jul 20, 2024	0.05% (0.00052)	21.27th	v3 (v2023.03.01)
Jun 1, 2024	0.05% (0.00052)	20.51th	v3 (v2023.03.01)
Sep 3, 2023	0.05% (0.00052)	18.51th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00044)	10.26th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00890)	30.33th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00890)	12.04th	v2 (v2022.01.01)
Feb 3, 2022	0.83% (0.00833)	24.58th	v5 (v2026.06.15)
Apr 14, 2021	0.83% (0.00833)	0.00th	v1

Weaknesses (1)

CWE-269

Improper Privilege Management

References (3)

http://www.securityfocus.com/bid/104718
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041314
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10857
x_refsource_CONFIRMMitigationVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/104718		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041314		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://kb.juniper.net/JSA10857		x_refsource_CONFIRMMitigationVendor Advisory