CVE-2026-21915

Katalog CVE

CVSS 6.7 · Medium EPSS 2,2%

Kerentanan Permissive List of Allowed Inputs pada juniper virtual lightweight collector. Skor CVSS 3.1 6.7 (Medium) menurut juniper.net.

Deskripsi (NVD)

A Permissive List of Allowed Input vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high privileged attacker to escalate their privileges to root. The CLI menu accepts input without carefully validating it, which allows for shell command injection. These shell commands are executed with root permissions and can be used to gain complete control of the system. This issue affects all JSI vLWC versions before 3.0.94.

Rincian

Terbit di NVD

9 April 2026

Terakhir diubah

8 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.7 (Medium), sumber juniper.net
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-183: Permissive List of Allowed Inputs
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://kb.juniper.net/JSA106016 advisory vendor