Local privilege escalation via readable commit file

Incorrect file permissions in Juniper Networks Junos OS and Junos OS Evolved allow local users to read committed configuration changes. A temporary file created during a privileged configuration commit remains readable to users who lack configuration-access permission, exposing password hashes when a password change is committed. Exploitation requires a low-privilege local account, user interaction through a concurrent authorized commit, and timing a password change; the documented consequence is credential-hash disclosure that supports privilege escalation.