An Unimplemented or Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series allows an unauthenticated, network-based attacker to cause a minor integrity impact to downstream networks.If one or more of the following match conditions

ip-source-address ip-destination-address arp-type

which are not supported for this type of filter, are used in an ethernet switching filter, and then this filter is applied as an output filter, the configuration can be committed but the filter will not be in effect.

This issue affects Junos OS on QFX5000 Series and EX4600 Series:

All version before 21.2R3-S7,  21.4 versions before 21.4R3-S6, 22.1 versions before 22.1R3-S5, 22.2 versions before 22.2R3-S3, 22.3 versions before 22.3R3-S2,  22.4 versions before 22.4R3, 23.2 versions before 23.2R2.

Please note that the implemented fix ensures these unsupported match conditions cannot be committed anymore.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause an integrity impact to the downstream devices.

When a peer sends a BGP update message which contains the aggregator attribute with an ASN value of zero (0), rpd accepts and propagates this attribute, which can cause issues for downstream BGP peers receiving this.

This issue affects:

Junos OS:

All versions before 21.4R3-S6, 22.2 versions before 22.2R3-S3, 22.4 versions before 22.4R3;

Junos OS Evolved:

All versions before 21.4R3-S7-EVO, 22.2 versions before 22.2R3-S4-EVO, 22.4 versions before 22.4R3-EVO.

An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

When a device configured for flow-monitoring receives a specific BGP update message, it is correctly processed internally by the routing protocol daemon (rpd), but when it's sent to SRRD it's encoded incorrectly which leads to a crash and momentary interruption of jflow processing until it automatically restarts. This issue does not affect traffic forwarding itself. This issue affects Junos OS:

All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10, 22.2 versions before 22.2R3-S6, 22.4 versions before 22.4R3, 23.2 versions before 23.2R1-S2, 23.2R2.

This issue does not affected Junos OS Evolved.

A Protection Mechanism Failure vulnerability in kernel filter processing of Juniper Networks Junos OS allows an attacker sending IPv6 traffic destined to the device to effectively bypass any firewall filtering configured on the interface.

Due to an issue with Junos OS kernel filter processing, the 'payload-protocol' match is not being supported, causing any term containing it to accept all packets without taking any other action. In essence, these firewall filter terms were being processed as an 'accept' for all traffic on the interface destined for the control plane, even when used in combination with other match criteria.

This issue only affects firewall filters protecting the device's control plane. Transit firewall filtering is unaffected by this vulnerability.

This issue affects Junos OS:

all versions before 21.2R3-S9,  from 21.4 before 21.4R3-S11,  from 22.2 before 22.2R3-S7,  from 22.4 before 22.4R3-S7,  from 23.2 before 23.2R2-S4,  from 23.4 before 23.4R2-S5,  from 24.2 before 24.2R2-S1,  from 24.4 before 24.4R1-S2, 24.4R2.

This is a more complete fix for previously published CVE-2024-21607 (JSA75748).

An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the

Juniper Web Device Manager

(J-Web).

When Juniper Secure connect (JSC) is enabled on specific interfaces, or multiple interfaces are configured for J-Web, the J-Web UI is reachable over more than the intended interfaces. This issue affects Junos OS:

all versions before 21.4R3-S9, 22.2 versions before 22.2R3-S5, 22.4 versions before 22.4R3-S5, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2.

An Authentication Bypass by Primary Weakness

in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited read-write access to files on the device. When the FTP server is enabled and a user named "ftp" or "anonymous" is configured, that user can login without providing the configured password and then has read-write access to their home directory.

This issue affects Junos OS:

all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S3, 23.4 versions before 23.4R2.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause an availability impact for downstream devices.

When an affected device receives a specific optional, transitive BGP attribute over an existing BGP session, it will be erroneously modified before propagation to peers. When the attribute is detected as malformed by the peers, these peers will most likely terminate the BGP sessions with the affected devices and thereby cause an availability impact due to the resulting routing churn.

This issue affects:

Junos OS:

all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2;

Junos OS Evolved:

all versions before 22.4R3-S8-EVO, 23.2 versions before 23.2R2-S5-EVO, 23.4 versions before 23.4R2-S6-EVO, 24.2 versions before 24.2R2-S2-EVO, 24.4 versions before 24.4R2-EVO.

An Improper Input Validation vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows a local, low-privileged attacker to cause a Denial of Service (DoS).

When a specific "clear" command is run, the Advanced Forwarding Toolkit manager (evo-aftmand-bt or evo-aftmand-zx) crashes and restarts.

The crash impacts all traffic going through the FPCs, causing a DoS. Running the command repeatedly leads to a sustained DoS condition. This issue affects Junos OS Evolved:

All versions before 20.4R3-S9-EVO,  from 21.2-EVO before 21.2R3-S7-EVO,  from 21.3-EVO before 21.3R3-S5-EVO,  from 21.4-EVO before 21.4R3-S6-EVO,  from 22.1-EVO before 22.1R3-S4-EVO,  from 22.2-EVO before 22.2R3-S3-EVO,  from 22.3-EVO before 22.3R3-S3-EVO,  from 22.4-EVO before 22.4R3-EVO, from 23.2-EVO before 23.2R2-EVO.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of protected files on the file system.

Through the execution of crafted CLI commands, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.

This issue affects Junos OS on SRX Series:

All versions before 21.4R3-S8,  22.2 before 22.2R3-S5,  22.3 before 22.3R3-S4,  22.4 before 22.4R3-S4,  23.2 before 23.2R2-S2,  23.4 before 23.4R2.

A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a local, low-privileged attacker to cause a Denial-of-Service (DoS).

When a specific command is executed, the pfe crashes. This will cause traffic forwarding to be interrupted until the system self-recovers. Repeated execution will create a sustained DoS condition.

This issue only affects MX Series devices with Line cards MPC1-MPC9. This issue affects: Junos OS on MX Series:

All versions before 21.4R3-S9, from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4, from 22.4 before 22.4R3-S2, from 23.2 before 23.2R2-S1, from 23.4 before 23.4R2.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the command-line interface (CLI) of Juniper Networks Junos OS on SRX Series devices allows a local, low-privileged user with access to the Junos CLI to view the contents of sensitive files on the file system.

Through the execution of either 'show services advanced-anti-malware' or 'show services security-intelligence' command, a user with limited permissions (e.g., a low privilege login class user) can access protected files that should not be accessible to the user. These files may contain sensitive information that can be used to cause further impact to the system.

This issue affects Junos OS SRX Series:

All versions before 21.4R3-S8,

from 22.2 before 22.2R3-S5,

from 22.3 before 22.3R3-S3, from 22.4 before 22.4R3-S2,

from 23.2 before 23.2R2-S1,

from 23.4 before 23.4R2.

An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem' command to cause the chassis daemon (chassisd) to crash and restart, resulting in a temporary Denial of Service (DoS). However, repeated execution of this command will eventually cause the chassisd process to fail to restart, impacting packet processing on the system.

This issue affects Junos OS on SRX1500, SRX4100, SRX4200:

All versions before 21.4R3-S9,  from 22.2 before 22.2R3-S5,  from 22.3 before 22.3R3-S4,  from 22.4 before 22.4R3-S4,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S1.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker to cause a Denial-of-Service (DoS).

When a specific "show bgp neighbor" CLI command is run, the rpd cpu utilization rises and eventually causes a crash and restart. Repeated use of this command will cause a sustained DoS condition.

The device is only affected if BGP RIB sharding and update-threading is enabled. This issue affects Junos OS:

All versions before 21.2R3-S9,  from 21.4 before 21.4R3-S8, from 22.2 before 22.2R3-S6,  from 22.4 before 22.4R3-S2,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2.

and Junos OS Evolved:

All versions before 21.2R3-S9-EVO,  from 21.4-EVO before 21.4R3-S8-EVO,  from 22.2-EVO before 22.2R3-S6-EVO,  from 22.4-EVO before 22.4R3-S2-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-EVO.

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged, authenticated attacker with access to the CLI to access sensitive information.

Through the execution of a specific show mgd command, a user with limited permissions (e.g., a low-privileged login class user) can access sensitive information such as hashed passwords, that can be used to further impact the system.

This issue affects Junos OS:  All versions before 21.4R3-S10, from 22.2 before 22.2R3-S5, from 22.4 before 22.4R3-S5,  from 23.2 before 23.2R2-S3,  from 23.4 before 23.4R2-S3.

Junos OS Evolved:

All versions before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO,  from 22.4-EVO before 22.4R3-S5-EVO,  from 23.2-EVO before 23.2R2-S3-EVO,  from 23.4-EVO before 23.4R2-S3-EVO.

An Improper Handling of Exceptional Conditions vulnerability in routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged attacker executing a CLI command to cause a Denial of Service (DoS).

When asregex-optimized is configured and a specific "show route as-path" CLI command is executed, the rpd crashes and restarts. Repeated execution of this command will cause a sustained DoS condition. This issue affects Junos OS:

All versions before 21.2R3-S9, from 21.4 before 21.4R3-S10, from 22.2 before 22.2R3-S6, from 22.4 before 22.4R3-S6, from 23.2 before 23.2R2-S3, from 23.4 before 23.4R2-S4, from 24.2 before 24.2R2.

and Junos OS Evolved: All versions before 21.2R3-S9-EVO, from 21.4-EVO before 21.4R3-S10-EVO, from 22.2-EVO before 22.2R3-S6-EVO, from 22.4-EVO before 22.4R3-S6-EVO, from 23.2-EVO before 23.2R2-S3-EVO, from 23.4-EVO before 23.4R2-S4-EVO, from 24.2-EVO before 24.2R2-EVO.

An Improper Access Control vulnerability in the User Interface (UI) of Juniper Networks Junos OS allows a local, low-privileged attacker to bring down an interface, leading to a Denial-of-Service.

Users with "view" permissions can run a specific request interface command which allows the user to shut down the interface. This issue affects Junos OS:

All versions before 21.2R3-S9, from 21.4 before 21.4R3-S11, from 22.2 before 22.2R3-S7, from 22.4 before 22.4R3-S7, from 23.2 before 23.2R2-S4, from 23.4 before 23.4R2-S5,   from 24.2 before 24.2R2-S1, from 24.4 before 24.4R1-S3, 24.4R2.

A Missing Release of Memory after Effective Lifetime vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low privileged user to cause an impact to the availability of the device.

When RIB sharding is enabled and a user executes one of several routing related 'show' commands, a certain amount of memory is leaked. When all available memory has been consumed rpd will crash and restart.

The leak can be monitored with the CLI command:

show task memory detail | match taskshardmgmtcookie

where the allocated memory in bytes can be seen to continuously increase with each exploitation.

This issue affects:

Junos OS:

all versions before 21.2R3-S9, 21.4 versions before 21.4R3-S11, 22.2 versions before 22.2R3-S7, 22.4 versions before 22.4R3-S7, 23.2 versions before 23.2R2-S4,  23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2, 24.4 versions before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

all versions before 22.2R3-S7-EVO 22.4-EVO versions before 22.4R3-S7-EVO, 23.2-EVO versions before 23.2R2-S4-EVO, 23.4-EVO versions before 23.4R2-S4-EVO, 24.2-EVO versions before 24.2R2-EVO,  24.4-EVO versions before 24.4R2-EVO.

An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with high privileges to modify the system configuration.

A user with limited configuration and commit permissions, using a specifically crafted annotate configuration command, can change any part of the device configuration.

This issue affects:

Junos OS:

all versions before 22.2R3-S7, 22.4 versions before 22.4R3-S7, 23.2 versions before 23.2R2-S4, 23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R2-S1, 24.4 versions before 24.4R1-S2, 24.4R2;

Junos OS Evolved:

all versions before 22.4R3-S7-EVO, 23.2-EVO versions before 23.2R2-S4-EVO, 23.4-EVO versions before 23.4R2-S5-EVO,  24.2-EVO versions before 24.2R2-S1-EVO

24.4-EVO versions before 24.4R2-EVO.

An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with low privileges to cause a Denial-of-Service (DoS).

When the command 'show route < ( receive-protocol | advertising-protocol ) bgp > detail' is executed, and at least one of the routes in the intended output has specific attributes, this will cause an rpd crash and restart. 'show route ... extensive' is not affected.

This issue affects:

Junos OS:

all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S5, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2;

Junos OS Evolved:

all versions before 22.4R3-S8-EVO,  23.2 versions before 23.2R2-S5-EVO, 23.4 versions before 23.4R2-S6-EVO, 24.2 versions before 24.2R2-S2-EVO, 24.4 versions before 24.4R2-EVO.

An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privileged user to write to the Unix socket used to manage the jdhcpd process, resulting in complete control over the resource.

This vulnerability allows any low-privileged user logged into the system to connect to the Unix socket and issue commands to manage the DHCP service, in essence, taking administrative control of the local DHCP server or DHCP relay.

This issue affects: Junos OS: all versions before 21.2R3-S10, all versions of 22.2, from 21.4 before 21.4R3-S12, from 22.4 before 22.4R3-S8, from 23.2 before 23.2R2-S5, from 23.4 before 23.4R2-S6, from 24.2 before 24.2R2-S2, from 24.4 before 24.4R2, from 25.2 before 25.2R1-S1, 25.2R2;

Junos OS Evolved: all versions before 22.4R3-S8-EVO, from 23.2 before 23.2R2-S5-EVO, from 23.4 before 23.4R2-S6-EVO, from 24.2 before 24.2R2-S2-EVO, from 24.4 before 24.4R2-EVO, from 25.2 before 25.2R1-S1-EVO, 25.2R2-EVO.

A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the method to collect FPC Ethernet firmware statistics of Juniper Networks Junos OS on MX10k Series allows a local, low-privileged attacker executing the 'show system firmware' CLI command to cause an LC480 or LC2101 line card to reset.

On MX10k Series systems with LC480 or LC2101 line cards, repeated execution of the 'show system firmware' CLI command can cause the line card to crash and restart. Additionally, some time after the line card crashes, chassisd may also crash and restart, generating a core dump.This issue affects Junos OS on MX10k Series:

all versions before 21.2R3-S10,  from 21.4 before 21.4R3-S9,  from 22.2 before 22.2R3-S7,  from 22.4 before 22.4R3-S6,  from 23.2 before 23.2R2-S2,  from 23.4 before 23.4R2-S3,  from 24.2 before 24.2R2.

A NULL Pointer Dereference vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with low privileges to cause a Denial-of-Service (DoS).

When a user executes the 'show chassis' command with specifically crafted options, chassisd will crash and restart. Due to this all components but the Routing Engine (RE) in the chassis are reinitialized, which leads to a complete service outage, which the system automatically recovers from.

This issue affects:

Junos OS on MX, SRX and EX Series, except MX10000 Series and MX304:

all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2.

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive information.

A local user with low privileges can execute the CLI command 'show mgd' with specific arguments which will expose sensitive information.

This issue affects

Junos OS: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S6, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S4, 24.4 versions before 24.4R2-S1, 25.2 version before 25.2R1-S2, 25.2R2;

Junos OS Evolved: all versions before 23.2R2-S6-EVO, 23.4 version before 23.4R2-S6-EVO, 24.2 version before 24.2R2-S4-EVO, 24.4 versions before 24.4R2-S1-EVO, 25.2 versions before 25.2R2-EVO.

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device.

A local attacker with access to the shell is able to inject arbitrary code which can compromise an affected device. This issue is not exploitable from the Junos CLI. This issue affects Junos OS:

All versions before 21.2R3-S9, 21.4 versions before 21.4R3-S10,  22.2 versions before 22.2R3-S6,  22.4 versions before 22.4R3-S6,  23.2 versions before 23.2R2-S3,  23.4 versions before 23.4R2-S4, 24.2 versions before 24.2R1-S2, 24.2R2.

An Incomplete Cleanup vulnerability in Nonstop active routing (NSR) component of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause memory leak leading to Denial of Service (DoS).

On all Junos OS platforms, when NSR is enabled, a BGP flap will cause memory leak. A manual reboot of the system will restore the services.

Note: NSR is not supported on the SRX Series and is therefore not affected by this vulnerability. The memory usage can be monitored using the below commands.

user@host> show chassis routing-engine no-forwarding user@host> show system memory | no-more This issue affects:

Juniper Networks Junos OS

21.2 versions earlier than 21.2R3-S5; 21.3 versions earlier than 21.3R3-S4; 21.4 versions earlier than 21.4R3-S4; 22.1 versions earlier than 22.1R3-S2; 22.2 versions earlier than 22.2R3-S2; 22.3 versions earlier than 22.3R2-S1, 22.3R3; 22.4 versions earlier than 22.4R1-S2, 22.4R2.

This issue does not affect Junos OS versions earlier than 20.4R3-S7.

An Improper Handling of Exceptional Conditions vulnerability in the broadband edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an attacker directly connected to the vulnerable system who repeatedly flaps DHCP subscriber sessions to cause a slow memory leak, ultimately leading to a Denial of Service (DoS). Memory can only be recovered by manually restarting bbe-smgd.

This issue only occurs if BFD liveness detection for DHCP subscribers is enabled. Systems without BFD liveness detection enabled are not vulnerable to this issue.

Indication of the issue can be observed by periodically executing the 'show system processes extensive' command, which will indicate an increase in memory allocation for bbe-smgd. A small amount of memory is leaked every time a DHCP subscriber logs in, which will become visible over time, ultimately leading to memory starvation.

user@junos> show system processes extensive | match bbe-smgd 13071 root 24 0 415M 201M select 0 0:41 7.28% bbe-smgd{bbe-smgd} 13071 root 20 0 415M 201M select 1 0:04 0.00% bbe-smgd{bbe-smgd} ... user@junos> show system processes extensive | match bbe-smgd 13071 root 20 0 420M 208M select 0 4:33 0.10% bbe-smgd{bbe-smgd} 13071 root 20 0 420M 208M select 0 0:12 0.00% bbe-smgd{bbe-smgd} ... This issue affects Juniper Networks Junos OS on MX Series:

All versions earlier than 20.4R3-S9; 21.2 versions earlier than 21.2R3-S7; 21.3 versions earlier than 21.3R3-S5; 21.4 versions earlier than 21.4R3-S5; 22.1 versions earlier than 22.1R3-S4; 22.2 versions earlier than 22.2R3-S3; 22.3 versions earlier than 22.3R3-S2; 22.4 versions earlier than 22.4R2-S2, 22.4R3; 23.2 versions earlier than 23.2R1-S1, 23.2R2.

An Expired Pointer Dereference vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause Denial of Service (DoS).On all Junos OS and Junos OS Evolved platforms, when an MPLS Label-Switched Path (LSP) is configured with node-link-protection and transport-class, and an LSP flaps, rpd crashes and restarts. Continuous flapping of LSP can cause a sustained Denial of Service (DoS) condition.

This issue affects:

Junos OS:

All versions before 22.2R3-S4,

22.4 versions before 22.4R3-S2,

23.2 versions before 23.2R2,

23.4 versions before 23.4R2.

Junos OS Evolved:

All versions before 22.2R3-S4-EVO,

22.4-EVO versions before 22.4R3-S2-EVO,

23.2-EVO versions before 23.2R2-EVO,

23.4-EVO versions before 23.4R2-EVO.

An Improper Validation of Syntactic Correctness of Input vulnerability in Routing Protocol Daemon (rpd) Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network based attacker to cause a Denial of Service (DoS).

When a malformed BGP UPDATE packet is received over an established BGP session, the rpd crashes and restarts.

This issue affects both eBGP and iBGP implementations.

This issue affects:

Juniper Networks Junos OS

21.4 versions prior to 21.4R3-S4; 22.1 versions prior to 22.1R3-S3; 22.2 versions prior to 22.2R3-S2; 22.3 versions prior to 22.3R2-S2, 22.3R3; 22.4 versions prior to 22.4R2-S1, 22.4R3; 23.2 versions prior to 23.2R1, 23.2R2;

Juniper Networks Junos OS Evolved

21.4 versions prior to 21.4R3-S5-EVO; 22.1 versions prior to 22.1R3-S3-EVO; 22.2 versions prior to 22.2R3-S3-EVO; 22.3 versions prior to 22.3R2-S2-EVO; 22.4 versions prior to 22.4R3-EVO; 23.2 versions prior to 23.2R2-EVO;

An Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in the management daemon (mgd) process of Juniper Networks Junos OS and Junos OS Evolved allows a network-based authenticated low-privileged attacker, by executing a specific command via NETCONF, to cause a CPU Denial of Service to the device's control plane.

This issue affects:

Juniper Networks Junos OS

All versions prior to 20.4R3-S7; 21.2 versions prior to 21.2R3-S5; 21.3 versions prior to 21.3R3-S5; 21.4 versions prior to 21.4R3-S4; 22.1 versions prior to 22.1R3-S2; 22.2 versions prior to 22.2R3; 22.3 versions prior to 22.3R2-S1, 22.3R3; 22.4 versions prior to 22.4R1-S2, 22.4R2.

Juniper Networks Junos OS Evolved

All versions prior to 21.4R3-S4-EVO; 22.1 versions prior to 22.1R3-S2-EVO; 22.2 versions prior to 22.2R3-EVO; 22.3 versions prior to 22.3R3-EVO; 22.4 versions prior to 22.4R2-EVO.

An indicator of compromise can be seen by first determining if the NETCONF client is logged in and fails to log out after a reasonable period of time and secondly reviewing the WCPU percentage for the mgd process by running the following command:

mgd process example:

user@device-re#> show system processes extensive | match "mgd|PID" | except last PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 92476 root 100 0 500M 89024K CPU3 3 57.5H 89.60% mgd <<<<<<<<<<< review the high cpu percentage. Example to check for NETCONF activity:

While there is no specific command that shows a specific session in use for NETCONF, you can review logs for UILOGEVENT with "client-mode 'netconf'"

For example:

mgd[38121]: UILOGINEVENT: User 'root' login, class 'super-user' [38121], ssh-connection '10.1.1.1 201 55480 10.1.1.2 22', client-mode 'netconf'

An Improper Check for Unusual or Exceptional Conditions in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS Evolved on PTX10003 Series allows an unauthenticated adjacent attacker to cause an impact to the integrity of the system.

When specific transit MPLS packets are received by the PFE, these packets are internally forwarded to the RE. This issue is a prerequisite for CVE-2023-44195.

This issue affects Juniper Networks Junos OS Evolved:

All versions prior to 20.4R3-S8-EVO; 21.1-EVO version 21.1R1-EVO and later; 21.2-EVO versions prior to 21.2R3-S6-EVO; 21.3-EVO version 21.3R1-EVO and later; 21.4-EVO versions prior to 21.4R3-S3-EVO; 22.1-EVO versions prior to 22.1R3-S4-EVO; 22.2-EVO versions prior to 22.2R3-S3-EVO; 22.3-EVO versions prior to 22.3R2-S2-EVO, 22.3R3-EVO; 22.4-EVO versions prior to 22.4R2-EVO.