Privilege escalation via writable shell configuration

Incorrect permissions in Juniper Networks Junos OS Evolved allow local users with CLI access to trigger arbitrary command execution. A shell-processing configuration file is writable by a low-privileged account and is later consumed when another user enters the Junos shell; Juniper has not disclosed the file's name. Exploitation requires a different user to open the shell, and an administrator's follow-on session grants the attacker complete control of the device.