Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Juniper Networks devices running vulnerable versions of Junos OS or Junos OS Evolved.
2. For CVE-2020-7450 (Junos OS Evolved): The attacker crafts and sends a malicious HTTP/HTTPS request containing a specially malformed URL to the target device.
3. The vulnerable libfetch component within Junos OS Evolved attempts to parse the malformed URL, triggering a heap buffer overflow condition.
4. This heap buffer overflow can be exploited by the attacker to achieve arbitrary code execution on the device, potentially leading to full system compromise.
5. For CVE-2026-33799 (Junos OS/Evolved): The attacker crafts and sends a specific, malformed SNMPv3 request to the vulnerable Juniper device.
6. The snmpd daemon on the device processes the crafted SNMPv3 request, which results in a memory leak within the daemon's allocated memory space.
7. The attacker continuously sends repeated crafted SNMPv3 requests, causing further memory leaks and gradually depleting the snmpd daemon's resources.
8. Eventually, the persistent memory exhaustion causes the snmpd daemon to crash, leading to a Denial of Service for SNMP services on the affected Juniper device.

Impact

The identified vulnerabilities pose significant risks to network infrastructure. Exploitation of CVE-2020-7450, a heap buffer overflow, could allow an unauthenticated attacker to achieve arbitrary code execution on Junos OS Evolved devices. This would grant the attacker full control over the device, enabling data exfiltration, network segmentation bypass, or further compromise of the internal network. CVE-2026-33799, a memory leak, can lead to a denial of service for SNMP services on both Junos OS and Junos OS Evolved. While not directly leading to system compromise, a crashed SNMP daemon can disrupt network monitoring, management, and potentially impact other critical services reliant on SNMP, leading to operational downtime and reduced visibility into network health.

Recommendation

• Immediately apply the recommended updates and patches provided by Juniper Networks for all affected products as detailed in the Juniper Networks security advisories linked in this brief.
• Ensure that internet-facing Junos OS Evolved devices are patched against CVE-2020-7450 to prevent potential arbitrary code execution.
• Verify that Junos OS and Junos OS Evolved devices are updated to mitigate CVE-2026-33799 and prevent SNMP service denial of service.
• Review the specific security bulletins (e.g., "2026-07 Security Bulletin: CTPView: Multiple vulnerabilities resolved in 9.3R2-3 Release", "2026-07 Security Bulletin: Junos Space: Multiple vulnerabilities resolved in 26.1R1 Patch V1 Release") for precise version requirements and update paths.