If it was poor implementation that&#x27;s not unauthorized code.
Also I don&#x27;t remember the last time that &quot;unauthorized code&quot; was used to describe the cause of a vulnerability, and code being committed without undergoing the full code review and compliance process is quite a common occurrence and also a common cause for some security vulnerabilities, especially ones that are easily caught by static code analysis.<p>The phrasing, the very specific nature of the vulnerabilities, the &quot;knowledgeable attacker&quot; requirement which means that you can&#x27;t just fuzz your way into it just like any other zero-day and the fact that some of the Snowden documents that were published mention an NSA specific backdoor for Juniper firewalls means make me think that this wasn&#x27;t an internal process failure.<p>If the process would&#x27;ve failed we would&#x27;ve gotten an advisory at the most without any specifics, the fact that they&#x27;ve intentionally mentioned that unauthorized code managed to get there is almost like a canary, they said that they&#x27;ve been breached without effectively saying that.