CVE-2023-44182
highpriority · track · 35EPSS 0.007 · 53 %ileDEEURUUSEPSS · scored 2026-10-27
An Unchecked Return Value vulnerability in the user interfaces to the Juniper Networks Junos OS and Junos OS Evolved, the CLI, the XML API, the XML Management Protocol, the NETCONF Management Protocol, the gNMI interfaces, and the J-Web User Interfaces causes unintended effects such as demotion or elevation of privileges associated with an operators actions to occur. Multiple scenarios may occur; for example: privilege escalation over the device or another account, access to files that should not otherwise be accessible, files not being accessible where they should be accessible, code expected to run as non-root may run as root, and so forth. This issue affects: Juniper Networks Junos OS * All versions prior to 20.4R3-S7; * 21.1 versions prior to 21.1R3-S5; * 21.2 versions prior to 21.2R3-S5; * 21.3 versions prior to 21.3R3-S4; * 21.4 versions prior to 21.4R3-S3; * 22.1 versions prior to 22.1R3-S2; * 22.2 versions prior to 22.2R2-S2, 22.2R3; * 22.3 versions prior to 22.3R1-S2, 22.3R2. Juniper Networks Junos OS Evolved * All versions prior to 21.4R3-S3-EVO; * 22.1-EVO version 22.1R1-EVO and later versions prior to 22.2R2-S2-EVO, 22.2R3-EVO; * 22.3-EVO versions prior to 22.3R1-S2-EVO, 22.3R2-EVO.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (58)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-2636Juniper Patchday Oktober 2023Deutsch2023-10-11csaf · cert_bundDE
Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Juniper Produkten ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und seine Privilegien zu erweitern.
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-44182/cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2023-44182cnnvd
- https://supportportal.juniper.net/JSA73149cnnvd
- https://vigilance.fr/vulnerability/Juniper-Junos-OS-multiple-vulnerabilities-42602cnnvd
- https://www.juniper.net/documentation/en_US/junos/topics/concept/junos-software-user-interfaces-overview.htmlcnnvd
- https://www.juniper.net/documentation/us/en/software/junos/interfaces-telemetry/topics/concept/junos-telemetry-interface-grpc-sensors.htmlcnnvd
- https://supportportal.juniper.net/JSA73149enisa_euvd
- https://www.juniper.net/documentation/en_US/junos/topics/concept/junos-software-user-interfaces-overview.htmlenisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan