Junos OS Evolved: User is not logged out when the console cable is disconnected

When someone physically disconnects the console cable from a Juniper device, the logged-in user session is not automatically ended. This allows an attacker with physical access to reconnect and take over an active user account, potentially gaining admin privileges.

An improper physical access control vulnerability in Junos OS Evolved's console port allows an unauthenticated attacker with physical proximity to resume an active console session when the cable is disconnected and reconnected. The vulnerability stems from the device failing to terminate user sessions upon console cable disconnection, enabling privilege escalation if the disconnected session had elevated permissions. Affected versions include 23.2R2-EVO before 23.2R2-S1-EVO and 23.4R1-EVO before 23.4R2-EVO.