Privilege Escalation in exclusive edit mode
Authenticated users with the ability to edit the configuration can bypass CLI restrictions.
New builds of Junos OS software are available from Juniper. As a workaround deny access to the 'load factory-default' command.
An escalation of privileges can occur when the 'load factory-default' command fails while in exclusive edit mode. When the load command fails, the user is no longer subject to any command and/or configuration restrictions. The escalation is limited to authenticated users with the ability to edit the configuration in the first place. The privilege bypass is specific to configured classes of CLI users with restrictions such as 'allow-commands', 'deny-commands', and 'deny-configuration'.
Junos OS 10.0, 10.4, 11.2, 11.3, 11.4 and 12.1.
Check the OS build.
Updated on 2015-03-25