An Out-of-bounds Write vulnerability in the SNMP daemon (snmpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated network-based attacker sending specific valid SNMPv3 queries to trigger a memory leak. Over time, continuous receipt of these queries will result in snmpd process memory exhaustion, resulting in a process crash and restart, impacting the ability to monitor the system via SNMP.

Memory usage can be monitored using the following command:

user@device> show system processes extensive | match snmpd

This issue affects:

Junos OS:

all versions before 21.2R3-S8; from 21.4 before 21.4R3-S7; from 22.1 before 22.1R3-S6; from 22.2 before 22.2R3-S4; from 22.3 before 22.3R3-S3; from 22.4 before 22.4R3-S2; from 23.2 before 23.2R2; from 23.4 before 23.4R2.

Junos OS Evolved: all versions before 21.2R3-S8-EVO; from 21.4 before 21.4R3-S7-EVO; all versions of 22.1-EVO, from 22.2 before 22.2R3-S4-EVO; from 22.3 before 22.3R3-S3-EVO; all versions of 22.4-EVO, from 23.2 before 23.2R2-EVO; from 23.4 before 23.4R2-EVO.

A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the method to collect FPC Ethernet firmware statistics of Juniper Networks Junos OS on MX10k Series allows a local, low-privileged attacker executing the 'show system firmware' CLI command to cause an LC480 or LC2101 line card to reset.

On MX10k Series systems with LC480 or LC2101 line cards, repeated execution of the 'show system firmware' CLI command can cause the line card to crash and restart. Additionally, some time after the line card crashes, chassisd may also crash and restart, generating a core dump.This issue affects Junos OS on MX10k Series:

all versions before 21.2R3-S10,  from 21.4 before 21.4R3-S9,  from 22.2 before 22.2R3-S7,  from 22.4 before 22.4R3-S6,  from 23.2 before 23.2R2-S2,  from 23.4 before 23.4R2-S3,  from 24.2 before 24.2R2.

An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to write to the Unix socket used to manage the jdhcpd process, resulting in complete control over the resource.

This vulnerability allows any low-privileged user logged into the system to connect to the Unix socket and issue commands to manage the DHCP service, in essence, taking administrative control of the local DHCP server or DHCP relay.

This issue affects: Junos OS: all versions before 21.2R3-S10, all versions of 22.2, from 21.4 before 21.4R3-S12, from 22.4 before 22.4R3-S8, from 23.2 before 23.2R2-S5, from 23.4 before 23.4R2-S6, from 24.2 before 24.2R2-S2, from 24.4 before 24.4R2, from 25.2 before 25.2R1-S1, 25.2R2;

Junos OS Evolved: all versions before 22.4R3-S8-EVO, from 23.2 before 23.2R2-S5-EVO, from 23.4 before 23.4R2-S6-EVO, from 24.2 before 24.2R2-S2-EVO, from 24.4 before 24.4R2-EVO, from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.

An Access of Uninitialized Pointer vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved with BGP sharding configured allows an attacker triggering indirect next-hop updates, along with timing outside the attacker's control, to cause rpd to crash and restart, leading to a Denial of Service (DoS).

With BGP sharding enabled, triggering route resolution of an indirect next-hop (e.g., an IGP route change over which a BGP route gets resolved), may cause rpd to crash and restart. An attacker causing continuous IGP route churn, resulting in repeated route re-resolution, will increase the likelihood of triggering this issue, leading to a potentially extended DoS condition.

This issue affects:

Junos OS:

all versions before 21.4R3-S6,  from 22.1 before 22.1R3-S6,  from 22.2 before 22.2R3-S3,  from 22.3 before 22.3R3-S3,  from 22.4 before 22.4R3,  from 23.2 before 23.2R2;

Junos OS Evolved:

all versions before 22.3R3-S3-EVO,  from 22.4 before 22.4R3-EVO,  from 23.2 before 23.2R2-EVO.

Versions before Junos OS 21.3R1 and Junos OS Evolved 21.3R1-EVO are unaffected by this issue.

An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the

Juniper Web Device Manager

(J-Web).

When Juniper Secure connect (JSC) is enabled on specific interfaces, or multiple interfaces are configured for J-Web, the J-Web UI is reachable over more than the intended interfaces. This issue affects Junos OS:

all versions before 21.4R3-S9, 22.2 versions before 22.2R3-S5, 22.4 versions before 22.4R3-S5, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2.

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device.

When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart.

The leak can be monitored with the CLI command:

show task memory detail | match taskshardmgmtcookie

where the allocated memory in bytes can be seen to continuously increase with each exploitation.

This issue affects:

Junos OS:

all versions before 21.2R3-S9, 21.4 versions before 21.4R3-S11, 22.2 versions before 22.2R3-S7, 22.4 versions before 22.4R3-S7, 23.2 versions before 23.2R2-S4,  23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2, 24.4 versions before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

all versions before 22.2R3-S7-EVO 22.4-EVO versions before 22.4R3-S7-EVO, 23.2-EVO versions before 23.2R2-S4-EVO, 23.4-EVO versions before 23.4R2-S4-EVO, 24.2-EVO versions before 24.2R2-EVO,  24.4-EVO versions before 24.4R2-EVO.

An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an interface, leading to a Denial-of-Service.

Users with "view" permissions can run a specific request interface command which allows the user to shut down the interface. This issue affects Junos OS:

All versions before 21.2R3-S9, from 21.4 before 21.4R3-S11, from 22.2 before 22.2R3-S7, from 22.4 before 22.4R3-S7, from 23.2 before 23.2R2-S4, from 23.4 before 23.4R2-S5,   from 24.2 before 24.2R2-S1, from 24.4 before 24.4R1-S3, 24.4R2.

A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface.

Due to an issue with Junos OS kernel filter processing, the 'payload-protocol' match is not being supported, causing any term containing it to accept all packets without taking any other action. In essence, these firewall filter terms were being processed as an 'accept' for all traffic on the interface destined for the control plane, even when used in combination with other match criteria.

This issue only affects firewall filters protecting the device's control plane. Transit firewall filtering is unaffected by this vulnerability.

This issue affects Junos OS:

all versions before 21.2R3-S9,  from 21.4 before 21.4R3-S11,  from 22.2 before 22.2R3-S7,  from 22.4 before 22.4R3-S7,  from 23.2 before 23.2R2-S4,  from 23.4 before 23.4R2-S5,  from 24.2 before 24.2R2-S1,  from 24.4 before 24.4R1-S2, 24.4R2.

This is a more complete fix for previously published CVE-2024-21607 (JSA75748).

An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When a device configured for flow-monitoring receives a specific BGP update message, it is correctly processed internally by the routing protocol daemon (rpd), but when it's sent to SRRD it's encoded incorrectly which leads to a crash and momentary interruption of jflow processing until it automatically restarts. This issue does not affect traffic forwarding itself. This issue affects Junos OS:

All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3, 23.2 versions before 23.2R1-S2, 23.2R2.

This issue does not affected Junos OS Evolved.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to cause a Denial-of-Service (DoS).

When a specific "show bgp neighbor" CLI command is run, the rpd cpu utilization rises and eventually causes a crash and restart. Repeated use of this command will cause a sustained DoS condition.

The device is only affected if BGP RIB sharding and update-threading is enabled. This issue affects Junos OS:

All versions before 21.2R3-S9,  from 21.4 before 21.4R3-S8, from 22.2 before 22.2R3-S6,  from 22.4 before 22.4R3-S2,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2.

and Junos OS Evolved:

All versions before 21.2R3-S9-EVO,  from 21.4-EVO before 21.4R3-S8-EVO,  from 22.2-EVO before 22.2R3-S6-EVO,  from 22.4-EVO before 22.4R3-S2-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-EVO.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged, authenticated attacker with access to the CLI to access sensitive information.

Through the execution of a specific show mgd command, a user with limited permissions (e.g., a low-privileged login class user) can access sensitive information such as hashed passwords, that can be used to further impact the system.

This issue affects Junos OS:  All versions before 21.4R3-S10, from 22.2 before 22.2R3-S5, from 22.4 before 22.4R3-S5,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S3.

Junos OS Evolved:

All versions before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO,  from 22.4-EVO before 22.4R3-S5-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-S3-EVO.

An Improper Handling of Exceptional Conditions vulnerability in routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker executing a CLI command to cause a Denial of Service (DoS).

When asregex-optimized is configured and a specific "show route as-path" CLI command is executed, the rpd crashes and restarts. Repeated execution of this command will cause a sustained DoS condition. This issue affects Junos OS:

All versions before 21.2R3-S9, from 21.4 before 21.4R3-S10, from 22.2 before 22.2R3-S6, from 22.4 before 22.4R3-S6, from 23.2 before 23.2R2-S3, from 23.4 before 23.4R2-S4, from 24.2 before 24.2R2.

and Junos OS Evolved: All versions before 21.2R3-S9-EVO, from 21.4-EVO before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO, from 22.4-EVO before 22.4R3-S6-EVO, from 23.2-EVO before 23.2R2-S3-EVO, from 23.4-EVO before 23.4R2-S4-EVO, from 24.2-EVO before 24.2R2-EVO.

An Improper Check for Unusual or Exceptional Conditions vulnerability in routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, logically adjacent BGP peer to cause Denial of Service (DoS).

On all Junos OS and Junos OS Evolved platforms, when BGP rib-sharding and update-threading are configured, and a BGP peer flap is done with specific timing, rpd crashes and restarts. Continuous peer flapping at specific time intervals will result in a sustained Denial of Service (DoS) condition.

This issue affects eBGP and iBGP, in both IPv4 and IPv6 implementations. This issue requires a remote attacker to have at least one established BGP session. The issue can occur with or without logical-systems enabled.

This issue affects: Junos OS:

All versions before 20.4R3-S8, 21.2 versions before 21.2R3-S6,

21.3 versions before 21.3R3-S5, 21.4 versions before 21.4R3-S4, 22.1 versions before 22.1R3-S3, 22.2 versions before 22.2R3-S1, 22.3 versions before 22.3R3, 22.4 versions before 22.4R3.

Junos OS Evolved:

All versions before 21.2R3-S6-EVO, 21.3-EVO versions before 21.3R3-S5-EVO, 21.4-EVO versions before 21.4R3-S4-EVO, 22.1-EVO versions before 22.1R3-S3-EVO, 22.2-EVO versions before :22.2R3-S1-EVO, 22.3-EVO versions before 22.3R3-EVO, 22.4-EVO versions before 22.4R3-EVO.

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.

A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS:

All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10,  22.2 versions before 22.2R3-S6,  22.4 versions before 22.4R3-S6,  23.2 versions before 23.2R2-S3,  23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R1-S2, 24.2R2.

An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem' command to cause the chassis daemon (chassisd) to crash and restart, resulting in a temporary Denial of Service (DoS). However, repeated execution of this command will eventually cause the chassisd process to fail to restart, impacting packet processing on the system.

This issue affects Junos OS on SRX1500, SRX4100, SRX4200:

All versions before 21.4R3-S9,  from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4,  from 22.4 before 22.4R3-S4,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S1.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system.

Through the execution of either 'show services advanced-anti-malware' or 'show services security-intelligence' command, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.

This issue affects Junos OS SRX Series:

All versions before 21.4R3-S8,

from 22.2 before 22.2R3-S5,

from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S2,

from 23.2 before 23.2R2-S1,

from 23.4 before 23.4R2.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause an integrity impact to the downstream devices.

When a peer sends a BGP update message which contains the aggregator attribute with an ASN value of zero (0), rpd accepts and propagates this attribute, which can cause issues for downstream BGP peers receiving this.

This issue affects:

Junos OS:

All versions before 21.4R3-S6, 22.2 versions before 22.2R3-S3, 22.4 versions before 22.4R3;

Junos OS Evolved:

All versions before 21.4R3-S7-EVO, 22.2 versions before 22.2R3-S4-EVO, 22.4 versions before 22.4R3-EVO.

A NULL Pointer Dereference vulnerability in the

packet forwarding engine (pfe) of Juniper Networks Junos OS on MX304, MX with MPC10/11/LC9600, and EX9200 with EX9200-15C allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS).

In a VPLS or Junos Fusion scenario, the execution of specific show commands will cause all FPCs hosting VPLS sessions or connecting to satellites to crash and restart.

This issue affects Junos on MX304, MX with MPC10/11/LC9600 and EX9200 with EX9200-15C:

All version before 21.2R3-S1, 21.3 versions before 21.3R3,  21.4 versions before 21.4R2.

A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a local, low-privileged attacker to cause a Denial-of-Service (DoS).

When a specific command is executed, the pfe crashes. This will cause traffic forwarding to be interrupted until the system self-recovers. Repeated execution will create a sustained DoS condition.

This issue only affects MX Series devices with Line cards MPC1-MPC9. This issue affects: Junos OS on MX Series:

All versions before 21.4R3-S9, from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4, from 22.4 before 22.4R3-S2, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R2.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of protected files on the file system.

Through the execution of crafted CLI commands, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.

This issue affects Junos OS on SRX Series:

All versions before 21.4R3-S8,  22.2 before 22.2R3-S5,  22.3 before 22.3R3-S4,  22.4 before 22.4R3-S4,  23.2 before 23.2R2-S2,  23.4 before 23.4R2.

A Missing Release of Memory after Effective Lifetime vulnerability in Juniper Networks Junos OS on MX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS).

In a subscriber management scenario continuous subscriber logins will trigger a memory leak and eventually lead to an FPC crash and restart.

This issue affects Junos OS on MX Series:

All version before 21.2R3-S6, 21.4 versions before 21.4R3-S6, 22.1 versions before 22.1R3-S5, 22.2 versions before 22.2R3-S3,  22.3 versions before 22.3R3-S2, 22.4 versions before 22.4R3, 23.2 versions before 23.2R2.

A Missing Release of Memory after Effective Lifetime vulnerability in the Periodic Packet Management Daemon (ppmd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a

Denial-of-Service (DoS).

When a BFD session configured with authentication flaps, ppmd memory can leak. Whether the leak happens depends on a race condition which is outside the attackers control. This issue only affects BFD operating in distributed aka delegated (which is the default behavior) or inline mode.

Whether the leak occurs can be monitored with the following CLI command:

show ppm request-queue

FPC     Pending-request fpc0                   2 request-total-pending: 2

where a continuously increasing number of pending requests is indicative of the leak.

This issue affects:

Junos OS:

All versions before 21.2R3-S8, 21.4 versions before 21.4R3-S7, 22.1 versions before 22.1R3-S4, 22.2 versions before 22.2R3-S4, 22.3 versions before 22.3R3, 22.4 versions before 22.4R2-S2, 22.4R3.

Junos OS Evolved: All versions before 21.2R3-S8-EVO, 21.4-EVO versions before 21.4R3-S7-EVO, 22.2-EVO versions before 22.2R3-S4-EVO, 22.3-EVO versions before 22.3R3-EVO, 22.4-EVO versions before 22.4R3-EVO.

An Unimplemented or Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an unauthenticated, network-based attacker to cause a minor integrity impact to downstream networks.If one or more of the following match conditions

ip-source-address ip-destination-address arp-type

which are not supported for this type of filter, are used in an ethernet switching filter, and then this filter is applied as an output filter, the configuration can be committed but the filter will not be in effect.

This issue affects Junos OS on QFX5000 Series and EX4600 Series:

All version before 21.2R3-S7,  21.4 versions before 21.4R3-S6, 22.1 versions before 22.1R3-S5, 22.2 versions before 22.2R3-S3, 22.3 versions before 22.3R3-S2,  22.4 versions before 22.4R3, 23.2 versions before 23.2R2.

Please note that the implemented fix ensures these unsupported match conditions cannot be committed anymore.

An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to access sensitive information.

When another user performs a specific operation, sensitive information is stored as plain text in a specific log file, so that a high-privileged attacker has access to this information. This issue affects:

Junos OS:

All versions before 21.2R3-S9;

21.4 versions before 21.4R3-S9;

22.2 versions before 22.2R2-S1, 22.2R3; 22.3 versions before 22.3R1-S1, 22.3R2;

Junos OS Evolved:

All versions before before 22.1R3-EVO; 22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO; 22.3-EVO versions before 22.3R1-S1-EVO, 22.3R2-EVO.

A Use After Free vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to cause a Denial of Service (DoS).On all Junos OS and Junos Evolved platforms, if a routing-instance deactivation is triggered, and at the same time a specific SNMP request is received, a segmentation fault occurs which causes rpd to crash and restart.

This issue affects:

Junos OS:

All versions before 21.2R3-S8,  21.4 versions before 21.4R3-S5, 22.2 versions before 22.2R3-S3, 22.3 versions before 22.3R3-S2, 22.4 versions before 22.4R3, 23.2 versions before 23.2R2.

Junos OS Evolved:

All versions before 21.2R3-S8-EVO, 21.4-EVO versions before 21.4R3-S5-EVO, 22.2-EVO versions before 22.2R3-S3-EVO,  22.3-EVO versions before 22.3R3-S2-EVO, 22.4-EVO versions before 22.4R3-EVO, 23.2-EVO versions before 23.2R2-EVO.

An Improper Input Validation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows a local, low-privileged attacker to cause a Denial of Service (DoS).

When a specific "clear" command is run, the Advanced Forwarding Toolkit manager (evo-aftmand-bt or evo-aftmand-zx) crashes and restarts.

The crash impacts all traffic going through the FPCs, causing a DoS. Running the command repeatedly leads to a sustained DoS condition. This issue affects Junos OS Evolved:

All versions before 20.4R3-S9-EVO,  from 21.2-EVO before 21.2R3-S7-EVO,  from 21.3-EVO before 21.3R3-S5-EVO,  from 21.4-EVO before 21.4R3-S6-EVO,  from 22.1-EVO before 22.1R3-S4-EVO,  from 22.2-EVO before 22.2R3-S3-EVO,  from 22.3-EVO before 22.3R3-S3-EVO,  from 22.4-EVO before 22.4R3-EVO, from 23.2-EVO before 23.2R2-EVO.

A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition.  The process crashes and restarts automatically.

When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash.  This process manages and controls the configuration of broadband subscriber sessions and services.  While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition.

This issue only occurs if Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled. This issue affects Junos OS:

All versions before 20.4R3-S5, from 21.1 before 21.1R3-S4, from 21.2 before 21.2R3-S3, from 21.3 before 21.3R3-S5, from 21.4 before 21.4R3-S5, from 22.1 before 22.1R3, from 22.2 before 22.2R3, from 22.3 before 22.3R2;

An Improper Restriction of Excessive Authentication Attempts vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause a limited Denial of Service (DoS) to the management plane.

When an incoming connection was blocked because it exceeded the connections-per-second rate-limit, the system doesn't consider existing connections anymore for subsequent connection attempts so that the connection limit can be exceeded. This issue affects Junos OS Evolved:

All versions before 21.4R3-S4-EVO, 22.1-EVO versions before 22.1R3-S3-EVO, 22.2-EVO versions before 22.2R3-S2-EVO,  22.3-EVO versions before 22.3R2-S1-EVO, 22.3R3-EVO.

An Incorrect Default Permissions vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to access confidential information on the system.

On all Junos OS and Junos OS Evolved platforms, when NETCONF traceoptions are configured, and a super-user performs specific actions via NETCONF, then a low-privileged user can access sensitive information compromising the confidentiality of the system. This issue affects:

Junos OS:

all versions before 21.2R3-S7,

from 21.4 before 21.4R3-S5,

from 22.1 before 22.1R3-S5,

from 22.2 before 22.2R3-S3,

from 22.3 before 22.3R3-S2,

from 22.4 before 22.4R3,

from 23.2 before 23.2R1-S2.

Junos OS Evolved:

all versions before 21.2R3-S7-EVO,

from 21.3 before 21.3R3-S5-EVO,

from 21.4 before 21.4R3-S5-EVO,

from 22.1 before 22.1R3-S5-EVO,

from 22.2 before 22.2R3-S3-EVO,

from 22.3 before 22.3R3-S2-EVO,

from 22.4 before 22.4R3-EVO,

from 23.2 before 23.2R1-S2.

An Improper Handling of Exceptional Conditions vulnerability in the Class of Service daemon (cosd) of Juniper Networks Junos OS allows an authenticated, network-based attacker with low privileges to cause a limited Denial of Service (DoS).

In a scaled CoS scenario with 1000s of interfaces, when specific low privileged commands, received over NETCONF, SSH or telnet, are handled by cosd on behalf of mgd, the respective child management daemon (mgd) processes will get stuck. In case of (Netconf over) SSH this leads to stuck SSH sessions, so that when the connection-limit for SSH is reached, new sessions can't be established anymore. A similar behavior will be seen for telnet etc.

Stuck mgd processes can be monitored by executing the following command:

user@host> show system processes extensive | match mgd | match sbwait

This issue affects Juniper Networks Junos OS: All versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S5; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R3; 23.2 versions earlier than 23.2R1-S2, 23.2R2.