CVE-2023-44194

On affected Junos OS releases a system directory ships with permissions that are too loose, and an attacker with local access to the device can drop files into it to create a backdoor that runs with root privileges. This isn't a remote break-in — it's a privilege and persistence flaw — but on a router or firewall, root is total control of the device and the traffic passing through it.

The precondition doing the heavy lifting is local access, which is why this is 8.4 rather than a remote 9-plus. In practice that access comes from an earlier foothold, an authorized-but-untrusted operator, or a lower-privileged account on the box; this bug is what turns any of those into durable root. It's a post-compromise escalation and persistence primitive on core network infrastructure, and a root backdoor on Junos survives reboots and blends into the platform.

Our prioritization keys on who can already reach these devices. We map Junos versions against the affected trains — everything before 20.4R3-S5 and the specified 21.x fixes — and weight them by how tightly local and management access is controlled. Where many hands touch a device, this escalation matters more; where access is locked down, it ranks below the remote unauthenticated bugs, though the root-persistence angle keeps it on the near-term patch list for network gear.