CVE-2026-102079

Executive Summary

CVE-2026-102079 is an OS command injection vulnerability (CWE-78) in the CLI of Juniper Networks Junos OS. A local, low-privileged attacker can abuse a specific request csds command that fails to sanitize user-supplied input, allowing that input to be interpreted as a command and executed with root privileges. Successful exploitation grants complete device control, enabling unauthorized system access or modification, and affects Junos OS 24.4 before 24.4R2-S4, 25.2 before 25.2R2-S1, and 25.4 before 25.4R1-S3.

Technical Analysis

The vulnerability resides in the Junos OS CLI, specifically in the handling of the request csds command. According to the NVD description, this command does not sanitize user-provided input, which allows that input to be interpreted as an operating system command rather than as data. This is the classic OS command injection pattern (CWE-78): untrusted input is passed to a shell or command interpreter without neutralization, permitting an attacker to break out of the intended argument context and append or substitute arbitrary shell commands.

Two properties of this flaw drive its severity:

1. Execution context. The injected command is executed with root privileges. Even though the attacker is described as "local" and "low privileged," the vulnerable process (the CLI command handler) runs with elevated rights, so the low-privileged user inherits root-level execution. This is a privilege-escalation outcome, not merely a data-exposure one.

2. Input handling failure. The root cause is the absence of input sanitization/validation on user-supplied input to the request csds command. The description does not specify the exact parameter name, argument syntax, or the shell/API invoked, so no additional internal detail can be asserted without fabrication. What can be stated definitively is that the input channel for request csds is the attack surface.

The CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects this: local access (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality, integrity, and availability impact (C:H/I:H/A:H). The 7.8 base score places this in the High severity band. Because the flaw requires local CLI access, it is primarily a post-authentication privilege-escalation and "break-glass to root" vector rather than a remote pre-auth entry point.

Affected releases are Junos OS 24.4 versions before 24.4R2-S4, 25.2 versions before 25.2R2-S1, and 25.4 versions before 25.4R1-S3. Junos OS releases before 24.4R1 are not affected, indicating the vulnerable code path was introduced in the 24.4R1 line and carried forward into the 25.x trains.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred strictly from the vulnerability class and the details in the NVD description.

1. Reconnaissance / target identification. The attacker needs local access to the Junos OS CLI — for example, a valid low-privileged account with CLI access (operational or restricted login class), a shared/jump-host session, or any position from which they can reach the local management/console interface of the device. Junos devices are commonly identified via management interfaces (SSH/HTTPS) exposed on the network; the request csds command is invoked from the device's own CLI.

2. Triggering the flaw. The attacker invokes the request csds command from the CLI and supplies crafted input in the argument space. Because the command does not sanitize this input, the input is not confined to its intended purpose and is instead interpreted as a command by the underlying interpreter. This is the exact mechanism described by the vendor: "A specific 'request csds' command doesn't sanitize user provided input so that it can be interpreted as a command."

3. Payload / execution. When the injected input is interpreted as a command, it executes with root privileges. At the vulnerability-class level, the attacker embeds an OS command in the input so that the CLI's shell processing executes it in place of, or in addition to, the legitimately intended operation. "This allows unintended command execution with root privileges."

4. Post-exploitation impact. With root command execution, the attacker achieves complete control of the device — the vendor states the attacker can "take complete control of the device" and that this "can lead to unauthorized system access or modification." Practical consequences include reading or exfiltrating device configuration and secrets (high confidentiality impact), altering configuration, routing, firewall filters, or user accounts (high integrity impact), and disrupting services or rebooting/halting the device (high availability impact). Persistence, credential harvesting, and use of the device as a pivot point are all within reach once root code execution is obtained.

The key exploitation constraint is the requirement for local CLI access with a low-privileged account. Any environment where such accounts exist (operators, contractors, monitoring accounts, or a compromised upstream host that can open a CLI session) is exposed.

Impact Assessment

CVE-2026-102079 carries a CVSS v3.1 base score of 7.8 (High), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The subscores map directly to operational risk:

• Confidentiality (C:H): Root command execution permits full read access to the device, including configuration, cryptographic material, and logs — high impact.
• Integrity (I:H): The attacker can modify configuration, routing, ACLs/filters, and system files, or install additional tooling — high impact.
• Availability (A:H): Root control enables service disruption, process termination, or device reset — high impact.
• PR:L / UI:N: Only low privileges and no user interaction are required, lowering the barrier once local access is obtained.
• AV:L: The attack requires local access, which limits it to authenticated/local vectors but does not reduce its severity once an attacker has any CLI foothold.

Blast radius. Junos OS is used in enterprise and service-provider routing and switching platforms (MX, PTX, QFX, EX, SRX series, depending on platform coverage for the affected release trains). A root compromise of a routing or security platform can cascade: an attacker who controls a core or edge device can redirect, inspect, or drop traffic, alter security policy on SRX platforms, and pivot deeper into the network. The "complete control of the device" character of this flaw means integrity of the broader network fabric can be affected.

Exploitability signals. There is currently no public PoC, no exploit code, and no Nuclei template, and the CVE is not listed in CISA KEV. The EPSS score is not yet assigned. These factors suggest limited observed exploitation at this time, but the low complexity (AC:L) and high impact make it an attractive post-access escalation primitive, and the absence of public exploit code does not reduce risk from an insider or an attacker who already holds a low-privileged account.

Environment-specific factors. Impact is highest where low-privileged CLI accounts are widely provisioned, where management interfaces are reachable from attacker-controllable hosts, and where the affected 24.4/25.2/25.4 trains are deployed on core, edge, or security-critical platforms.

Detection Guidance

Detection strategy should focus on (a) command activity invoking request csds with suspicious or metacharacter-laden arguments, (b) anomalous child processes or shell activity spawned with root privileges from the CLI subsystem, and (c) any post-exploitation changes to configuration or user accounts. Because the flaw is local to the device CLI, the most reliable telemetry comes from Junos system logs, command accounting, and process execution auditing rather than network inspection alone.

Sigma Rule

This rule targets CLI command auditing / process-creation telemetry for the vulnerable command on Junos and similar appliances. Field names are generic and should be mapped to the customer's collector (e.g., Junos mgd/command accounting, syslog pipeline).

title: Suspected OS Command Injection via Junos 'request csds' CLI Command
id: 8f2c1e6a-1020-79c0-9a11-7d3e4b6f1c02
status: experimental
description: Detects invocation of the Junos 'request csds' command with shell metacharacters in the argument, indicative of CVE-2026-102079 command injection.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102079
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains: 'request csds'
  selection_meta:
    CommandLine|contains:
      - ';'
      - '&&'
      - '||'
      - '`'
      - '$('
      - '|'
  condition: selection_cmd and selection_meta
fields:
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate administrative scripts that pass unusual but benign arguments (rare)
level: high
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.102079

YARA Rule

This rule scans device logs and exported CLI/command-accounting text captured during incident response for the vulnerable command combined with shell-injection metacharacters.

rule CVE_2026_102079_Junos_request_csds_injection
{
    meta:
        description = "Detects command injection attempts against the Junos 'request csds' CLI command (CVE-2026-102079)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102079"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cmd = "request csds" ascii nocase
        $m1  = ";" ascii
        $m2  = "&&" ascii
        $m3  = "||" ascii
        $m4  = "$(" ascii
        $m5  = "`" ascii

    condition:
        $cmd and any of ($m*)
}

Suricata IDS Rule

Network-layer detection is limited for this local CLI flaw; the rule below triggers on management/console traffic containing the request csds command with shell metacharacters, useful where CLI sessions traverse the monitored segment (e.g., SSH on port 22 to a Junos device).

alert tcp any any -> any 22 (msg:"CVE-2026-102079 Junos request csds CLI command injection attempt"; flow:established,to_server; content:"request csds"; nocase; content:";"; within:120; classtype:attempted-admin; reference:cve,2026-102079; sid:2026102079; rev:1;)

Elastic Detection

EQL hunting rule for CLI/process auditing pipelines. Adjust index and field names to the environment's Junos command-accounting or endpoint telemetry.

process where process.command_line != null and
  process.command_line : "request csds" and
  (
    process.command_line : "*;*" or
    process.command_line : "*&&*" or
    process.command_line : "*||*" or
    process.command_line : "*$(*" or
    process.command_line : "*`*"
  )

Splunk SPL Query

This query searches process-creation or command-accounting logs for the vulnerable command with injection metacharacters, grouped to surface repeated or single high-risk attempts by host and user.

index=junos OR index=os
| eval cl = coalesce(CommandLine, command_line, cmd, message)
| where match(lower(cl), "request csds")
| where match(cl, "(;|&&|\|\||\$\(|`|\| )")
| stats count min(_time) as first_seen max(_time) as last_seen values(cl) as command_lines by host, User
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

Custom decoder/rule pair to alert when a Junos command-accounting or syslog message shows the request csds command combined with shell metacharacters. Place the rule in the local ruleset.

<group name="junos,cve-2026-102079,">
  <rule id="1002079" level="12">
    <decoded_as>junos-cli</decoded_as>
    <match>request csds</match>
    <regex>;|&amp;&amp;|\|\||\$\s*\(|`</regex>
    <description>CVE-2026-102079: Junos 'request csds' CLI command injection attempt detected</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>privilege_escalation,cve_2026_102079,</group>
  </rule>
</group>

Note: The Wazuh rule assumes a custom decoder (junos-cli) that extracts the CLI command text into the buffered context. Deploy the decoder alongside this rule and tune the <regex> if the platform stores arguments in a separate field.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor workaround is provided in the available data, and no explicit patch reference has been confirmed from tracked sources. The fixed release versions below are those stated as the resolution boundary in the CVE description; they should be validated against Juniper's official advisory before deployment.

1. Immediate mitigations (until a verified patch is applied):

   • Restrict local CLI access. Limit which accounts can reach the device CLI and enforce least privilege; remove or disable unnecessary low-privileged CLI accounts (the exploit requires only low privileges).
   • Restrict management access. Use loopback/management-only interfaces, ACLs, firewall filters, and out-of-band management (console/jump hosts) to prevent untrusted hosts from opening CLI sessions.
   • Centralize and protect interactive access. Route CLI access through audited jump servers with MFA, and monitor for use of the request csds command.
   • Increase command logging. Enable command accounting/logging and forward Junos logs to a SIEM so that any attempt to invoke request csds with unusual arguments is captured and alerted (see Detection Guidance).
   • Segment management planes so that compromise of a low-privileged host does not grant CLI reach to affected routers/switches/firewalls.

2. Patch / upgrade steps:

   • Upgrade to Junos OS 24.4R2-S4 (for the 24.4 train), 25.2R2-S1 (for the 25.2 train), or 25.4R1-S3 (for the 25.4 train), as these are the versions stated in the CVE description as preceding-fixed.
   • Before upgrading, confirm the exact platform and release train, verify the fix against Juniper's official security advisory, and follow Juniper's standard upgrade procedures and prerequisites (schema/upgrade path validation).
   • Track the CVE for an updated vendor advisory; patch confidence is currently 0/4, so the fixed-version information must be re-verified from authoritative sources before relying on it.

3. Long-term hardening:

   • Adopt a "local CLI access is privileged" model: minimize accounts that can reach the device CLI and apply role-based access control (login classes).
   • Eliminate shared accounts and enforce unique per-user credentials with MFA on management paths.
   • Deploy continuous configuration and integrity monitoring to detect unauthorized changes (new users, filter changes, routing changes) that would follow an exploitation event.
   • Maintain a prompt firmware/OS patch cadence for network infrastructure, including a documented risk process for devices that cannot be upgraded quickly.
   • Test and validate input sanitization expectations for CLI commands during platform hardening reviews, and monitor vendor advisories for this and related CWE-78 issues in Junos OS.

References

• NVD — CVE-2026-102079: https://nvd.nist.gov/vuln/detail/CVE-2026-102079
• MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1068 — Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Juniper Networks Security Advisories (verify CVE-2026-102079 and the fixed releases 24.4R2-S4 / 25.2R2-S1 / 25.4R1-S3): https://supportportal.juniper.net/s/global-search/%40uri#q=security%20advisories
• CISA Known Exploited Vulnerabilities Catalog (check current status — CVE-2026-102079 was not listed at the time of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is known for this CVE at the time of writing, and there is no evidence of exploit-in-the-wild activity or named threat-actor campaigns associated with CVE-2026-102079. The EPSS score is not yet assigned by FIRST.org.