CVE-2021-0223: Juniper Junos Privilege Escalation Flaw

CVE-2021-0223 Overview

CVE-2021-0223 is a local privilege escalation vulnerability in the telnetd.real binary shipped with Juniper Networks Junos OS. The binary is installed with setuid permissions and owned by root, which allows any locally authenticated shell user to execute it with root privileges. An attacker with low-privilege shell access can leverage this misconfiguration to escalate privileges and execute arbitrary commands as root. The flaw is classified under CWE-250 (Execution with Unnecessary Privileges) and CWE-269 (Improper Privilege Management). Juniper addressed the issue in the security advisory JSA11114.

Critical Impact

A locally authenticated shell user can execute arbitrary commands as root on Junos OS devices, gaining full control of affected network infrastructure.

Affected Products

• Juniper Junos OS all versions prior to 15.1R7-S9
• Juniper Junos OS 17.3, 17.4, 18.1, 18.2, 18.3, 18.4 (multiple sub-versions prior to fixed releases)
• Juniper Junos OS 19.1, 19.2, 19.3, 19.4, 20.1, 20.2 (multiple sub-versions prior to fixed releases)

Discovery Timeline

• 2021-01-15 - CVE-2021-0223 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-0223

Vulnerability Analysis

The vulnerability resides in the telnetd.real binary shipped with Junos OS. Juniper installs this binary with the setuid bit enabled and root ownership. When a low-privilege shell user invokes telnetd.real, the kernel elevates the effective user ID to root for the duration of execution. The daemon was not designed to be safely invoked by unprivileged users from a local shell context. An attacker can leverage this execution context to perform privileged operations or pivot to arbitrary command execution as root.

Root Cause

The root cause is a configuration and design flaw: telnetd.real should not require setuid root permissions to function in its intended network-launched role. Granting setuid root to a binary that is reachable from a user shell violates the principle of least privilege ([CWE-250]). Combined with improper privilege management ([CWE-269]), this allows any locally authenticated user to inherit root capabilities simply by executing the binary.

Attack Vector

Exploitation requires local shell access on the Junos OS device with valid authentication. Once an attacker has shell access, they invoke telnetd.real directly. Because the binary runs with effective UID 0, the attacker can manipulate the daemon's behavior to spawn a root shell or execute commands with root privileges. No user interaction beyond the initial shell access is required, and exploitation complexity is low.

No verified public proof-of-concept code is available for CVE-2021-0223.
Refer to Juniper Security Advisory JSA11114 for vendor-confirmed technical details.

Detection Methods for CVE-2021-0223

Indicators of Compromise

• Unexpected invocations of /usr/sbin/telnetd.real or equivalent paths by non-root shell users in Junos OS audit logs
• Shell sessions where the effective UID transitions from a non-zero user to root without an explicit su or sudo invocation
• Creation of new privileged user accounts or modification of /etc/master.passwd shortly after a shell login

Detection Strategies

• Audit setuid binaries on Junos OS file systems and flag any execution of telnetd.real by non-administrative users
• Correlate shell login events with subsequent process executions running as root to identify privilege transitions
• Monitor Junos OS syslog for UI_CMDLINE_READ_LINE and shell command events tied to telnet binary execution

Monitoring Recommendations

• Forward Junos OS syslog and command accounting logs to a centralized SIEM for behavioral analysis
• Establish a baseline of expected telnetd.real invocations and alert on deviations
• Track all local shell user activity on Junos devices, especially commands executed within minutes of login

How to Mitigate CVE-2021-0223

Immediate Actions Required

• Upgrade Junos OS to a fixed release listed in Juniper Security Advisory JSA11114
• Restrict local shell access on Junos OS devices to a minimal set of trusted administrators
• Review and rotate credentials for any account with local shell access on affected devices

Patch Information

Juniper Networks released patched versions across all affected release trains. Fixed versions include 15.1R7-S9, 17.3R3-S11, 17.4R2-S12, 17.4R3-S3, 18.1R3-S11, 18.2R3-S6, 18.3R2-S4, 18.3R3-S4, 18.4R2-S7, 18.4R3-S6, 19.1R2-S2, 19.1R3-S4, 19.2R1-S6, 19.2R3-S1, 19.3R3-S1, 19.4R2-S2, 19.4R3, 20.1R1-S4, 20.1R2, 20.2R2, and all subsequent releases. Refer to JSA11114 for the complete fixed-version matrix.

Workarounds

• Limit shell access strictly to trusted administrators using Junos OS authentication classes and login configuration
• Disable or remove the setuid bit on telnetd.real if operationally feasible and supported by your Juniper service contract
• Enforce role-based access control and monitor command accounting to reduce the local attack surface

# Example: restrict shell login class permissions in Junos OS
set system login class restricted-users permissions [ network view ]
set system login user operator class restricted-users
commit