CVE-2026-57031: Junos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effect
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters.
On MX Series devices with MPC10/11, LC4800/9600, and MX304 with subscribers configured on static interfaces, ingress firewall filters are not enforced, so that neither protocol level nor upstream bandwidth limitation are in effect.
This issue affects Junos OS on MX with MPC10/11, LC4800/9600/4802, and MX304:
23.2 versions from 23.2R2-S1 before 23.2R2-S7, 23.4 versions from 23.4R2 before 23.4R2-S7, 24.2 versions before 24.2R2-S3, 24.4 versions before 24.4R2-S2, 25.2 versions before 25.2R2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Juniper Networks Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 23.2R2-S7 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 23.4R2-S7 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 24.2R2-S3 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 24.4R2-S2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 25.2R2 - Upgrade
Upgrade
Juniper Networks Junos OS (MX Series)to a version that resolves this vulnerability.Fixed in 25.4R1 - Compensating control
For MX Series devices with subscribers configured on static interfaces, ingress firewall filters are not enforced (so protocol-level and upstream bandwidth limitation are not in effect). Use an external compensating control (e.g., firewall/ACL/WAF and/or network policy) to enforce equivalent filtering for those static-interface subscribers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57031?
The severity of CVE-2026-57031 is rated as medium with a CVSS score of 4.7.
How do I fix CVE-2026-57031?
To fix CVE-2026-57031, ensure that the input filters are correctly applied for subscribers configured on static interfaces.
What are the affected devices for CVE-2026-57031?
CVE-2026-57031 affects MX Series devices with MPC10/11, LC4800/9600, and MX304 configurations.
What type of vulnerability is CVE-2026-57031?
CVE-2026-57031 is categorized as an Improper Check for Unusual or Exceptional Conditions vulnerability.
What is the impact of CVE-2026-57031?
CVE-2026-57031 allows adjacent subscribers to bypass configured firewall filters, potentially compromising network security.