CVE-2023-44194
Reported by juniper · Published October 12, 2023
An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS allows an unauthenticated attacker with local access to the device to create a backdoor with root privileges. The issue is caused by improper directory permissions on a certain system directory, allowing an attacker with access to this directory to create a backdoor with root privileges. This issue affects Juniper Networks Junos OS: * All versions prior to 20.4R3-S5; * 21.1 versions prior to 21.1R3-S4; * 21.2 versions prior to 21.2R3-S4; * 21.3 versions prior to 21.3R3-S3; * 21.4 versions prior to 21.4R3-S1.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| junos | juniper | 20.4 |
| Junos OS | Juniper Networks | 22.4R2, 22.3R2-S2, 22.3R3, 22.2R3-S1, 22.1R3-S3, 22.1R1-S2, 22.1R2, 21.4R3-S4, 21.4R3-S1, 21.4R2-S2, 21.4R3, 21.3R3-S5, 21.3R3-S3, 21.3R3, 21.2R3-S6, 21.2R3-S4, 21.2R3-S2, 21.1R3-S4, 20.4R3-S8, 20.4R3-S5 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Juniper Networks | Junos OS | 0, 21.1, 21.2 |
| Juniper Networks | Junos OS | 0, 21.1, 21.2 |
Timeline
- Oct 11, 2023 CVE Published
- Oct 13, 2023 EPSS Score (30 in total, the first dated here)
- Feb 27, 2025 CVE Updated
- Jun 2, 2026 Security Advisory
- Aug 2, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-44194
vulnetix vdb fixes CVE-2023-44194Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-44194/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart