CVE-2022-22221

Junos OS: SRX and EX Series: Local privilege escalation flaw in "download" functionality

HIGH

7.8

CVSS Score

Published: July 20, 2022 at 02:15 PM UTC

Updated: June 17, 2026 at 04:28 AM UTC

85 products affected across 2 vendorsJunosSRX5600SRX5800

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

Description

An Improper Neutralization of Special Elements vulnerability in the download manager of Juniper Networks Junos OS on SRX Series and EX Series allows a locally authenticated attacker with low privileges to take full control over the device. One aspect of this vulnerability is that the attacker needs to be able to execute any of the "request ..." or "show system download ..." commands. This issue affects Juniper Networks Junos OS on SRX Series and EX Series: All versions prior to 19.2R1-S9, 19.2R3-S5; 19.3 versions prior to 19.3R3-S6; 19.4 versions prior to 19.4R3-S8; 20.1 versions prior to 20.1R3-S4; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2, 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R2-S2, 21.2R3; 21.3 versions prior to 21.3R2, 21.3R3; 21.4 versions prior to 21.4R1-S1, 21.4R2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

v < 19.1R3-S9v < 19.219.2 ≤ v < 19.2R1-S9, 19.2R3-S519.3 ≤ v < 19.3R3-S619.4 ≤ v < 19.4R3-S820.1 ≤ v < 20.1R3-S420.2 ≤ v < 20.2R3-S420.3 ≤ v < 20.3R3-S320.4 ≤ v < 20.4R3-S2, 20.4R3-S321.1 ≤ v < 21.1R3-S121.2 ≤ v < 21.2R2-S2, 21.2R321.3 ≤ v < 21.3R2, 21.3R321.4 ≤ v < 21.4R1-S1, 21.4R219.2 19.2 r1 19.2 r1-s1 19.2 r1-s2 19.2 r1-s3 19.2 r1-s4 19.2 r1-s5 19.2 r1-s6 19.2 r1-s7 19.2 r1-s8 19.2 r2 19.2 r2-s1 19.2 r3 19.2 r3-s1 19.2 r3-s2 19.2 r3-s3 19.2 r3-s4 19.3 19.3 r1 19.3 r1-s1 19.3 r2 19.3 r2-s1 19.3 r2-s2 19.3 r2-s3 19.3 r2-s4 19.3 r2-s5 19.3 r2-s6 19.3 r3 19.3 r3-s1 19.3 r3-s2 19.3 r3-s3 19.3 r3-s4 19.3 r3-s5 19.4 19.4 r1 19.4 r1-s1 19.4 r1-s2 19.4 r1-s3 19.4 r1-s4 19.4 r2 19.4 r2-s1 19.4 r2-s2 19.4 r2-s3 19.4 r2-s4 19.4 r2-s5 19.4 r2-s6 19.4 r3 19.4 r3-s1 19.4 r3-s2 19.4 r3-s3 19.4 r3-s4 19.4 r3-s5 19.4 r3-s6 19.4 r3-s7 20.1 20.1 r1 20.1 r1-s1 20.1 r1-s2 20.1 r1-s3 20.1 r1-s4 20.1 r2 20.1 r2-s1 20.1 r2-s2 20.1 r3 20.1 r3-s1 20.1 r3-s2 20.1 r3-s3 20.2 20.2 r1 20.2 r1-s1 20.2 r1-s2 20.2 r1-s3 20.2 r2 20.2 r2-s1 20.2 r2-s2 20.2 r2-s3 20.2 r3 20.2 r3-s1 20.2 r3-s2 20.2 r3-s3 20.3 20.3 r1 20.3 r1-s1 20.3 r1-s2 20.3 r2 20.3 r2-s1 20.3 r3 20.3 r3-s1 20.3 r3-s2 20.4 20.4 r1 20.4 r1-s1 20.4 r2 20.4 r2-s1 20.4 r2-s2 20.4 r3 20.4 r3-s1 21.1 21.1 r1 21.1 r1-s1 21.1 r2 21.1 r2-s1 21.1 r2-s2 21.1 r3 21.2 21.2 r1 21.2 r1-s1 21.2 r1-s2 21.2 r2 21.2 r2-s1 21.3 21.3 r1 21.3 r1-s1 21.3 r1-s2 21.4 21.4 r1

Affected range stops below 19.1R3-S9, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2R1-S9, 19.2R3-S5, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.3R3-S6, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.4R3-S8, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.1R3-S4, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.2R3-S4, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.3R3-S3, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.4R3-S2, 20.4R3-S3, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.1R3-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.2R2-S2, 21.2R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.3R2, 21.3R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.4R1-S1, 21.4R2, so it looks safe — our inference, not a vendor statement

juniper-ex-redundant-power-system (environment) · juniper-ex2200 (environment) · juniper-ex2200-c (environment) · juniper-ex2200-vc (environment) · juniper-ex2300 (environment) · juniper-ex2300-c (environment) · juniper-ex2300m (environment) · juniper-ex3200 (environment) · juniper-ex3300 (environment) · juniper-ex3300-vc (environment) · juniper-ex3400 (environment) · juniper-ex4200 (environment) · juniper-ex4200-vc (environment) · juniper-ex4300 (environment) · juniper-ex4300-24p (environment) · juniper-ex4300-24p-s (environment) · juniper-ex4300-24t (environment) · juniper-ex4300-24t-s (environment) · juniper-ex4300-32f (environment) · juniper-ex4300-32f-dc (environment) · juniper-ex4300-32f-s (environment) · juniper-ex4300-48mp (environment) · juniper-ex4300-48mp-s (environment) · juniper-ex4300-48p (environment) · juniper-ex4300-48p-s (environment) · juniper-ex4300-48t (environment) · juniper-ex4300-48t-afi (environment) · juniper-ex4300-48t-dc (environment) · juniper-ex4300-48t-dc-afi (environment) · juniper-ex4300-48t-s (environment) · juniper-ex4300-48tafi (environment) · juniper-ex4300-48tdc (environment) · juniper-ex4300-48tdc-afi (environment) · juniper-ex4300-mp (environment) · juniper-ex4300-vc (environment) · juniper-ex4300m (environment) · juniper-ex4400 (environment) · juniper-ex4500 (environment) · juniper-ex4500-vc (environment) · juniper-ex4550 (environment) · juniper-ex4550-vc (environment) · juniper-ex4600 (environment) · juniper-ex4600-vc (environment) · juniper-ex4650 (environment) · juniper-ex6200 (environment) · juniper-ex6210 (environment) · juniper-ex8200 (environment) · juniper-ex8200-vc (environment) · juniper-ex8208 (environment) · juniper-ex8216 (environment) · juniper-ex9200 (environment) · juniper-ex9204 (environment) · juniper-ex9208 (environment) · juniper-ex9214 (environment) · juniper-ex9250 (environment) · juniper-ex9251 (environment) · juniper-ex9253 (environment) · juniper-srx100 (environment) · juniper-srx110 (environment) · juniper-srx1400 (environment) · juniper-srx1500 (environment) · juniper-srx210 (environment) · juniper-srx220 (environment) · juniper-srx240 (environment) · juniper-srx240h2 (environment) · juniper-srx300 (environment) · juniper-srx320 (environment) · juniper-srx340 (environment) · juniper-srx3400 (environment) · juniper-srx345 (environment) · juniper-srx3600 (environment) · juniper-srx380 (environment) · juniper-srx4000 (environment) · juniper-srx4100 (environment) · juniper-srx4200 (environment) · juniper-srx4600 (environment) · juniper-srx5000 (environment) · juniper-srx5400 (environment) · juniper-srx550 (environment) · juniper-srx550-hm (environment) · juniper-srx550m (environment) · juniper-srx5600 (environment) · juniper-srx5800 (environment) · juniper-srx650 (environment)

Ex Redundant Power System · Juniperdevice

80%

All versions

Ex2200 · Juniperdevice

80%

All versions

Ex2200-C · Juniperdevice

80%

All versions

Ex2200-Vc · Juniperdevice

80%

All versions