Attack Chain

1. Attacker authenticates with a read-only account via the REST API to obtain a JWT.
2. Attacker invokes 'POST /jsonrpc/?show' with 'method: "cli"' to execute restricted commands like 'show configuration' and 'show accounts'.
3. The API returns sensitive data, including SHA-256 crypt password hashes, which the attacker cracks offline to gain administrative access.

Impact

Exploitation results in the disclosure of device configuration, routing policies, and local account password hashes, enabling full administrative compromise through offline brute-force attacks.

Recommendation

Refer to the official vendor advisory for patching guidance and administrative restrictions.