PT-2024-7780 · Juniper Networks · Junos Space

Published 2024-10-09 · Updated 2026-01-23 · CVE-2024-39563

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Junos Space version 24.1R1

Description A Command Injection issue in Juniper Networks Junos Space allows an unauthenticated, network-based attacker to execute arbitrary shell commands on the Junos Space Appliance by sending a specially crafted request. This is due to insufficient input sanitization in a specific script within the Junos Space web application, allowing attacker-controlled input from a GET request to exploit the vulnerability and gain complete control of the device.

Recommendations For Junos Space version 24.1R1, consider disabling the vulnerable script in the web application as a temporary workaround until a patch is available. Restrict access to the Junos Space Appliance to minimize the risk of exploitation. Avoid using the affected script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-09276

CVE-2024-39563

Affected Products

Junos Space

References · 7

• https://supportportal.juniper.net/JSA88110 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-39563 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09276 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-39563 · Security Note
• https://twitter.com/cracbot/status/1846430954354786507 · Twitter Post
• https://t.me/cveNotify/149750 · Telegram Post
• https://vuldb.com/?id.280088 · Note