Junos OS vulnerabilities

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine of Junos OS on QFX10000 Series in an EVPN-VxLAN scenario allows an unauthenticated adjacent attacker to cause a DoS. Sending IPv6 multicast traffic to a non-IRB interface on a spine switch triggers an endless forwarding loop, saturating links and impacting legitimate traffic.

An improper validation of specified quantity in input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). A crafted packet triggers incorrect size calculation, leading to an FPC major error and reset, disrupting traffic until recovery.

A missing authorization vulnerability in the CLI of Junos OS on EX2300, EX4000, EX4100, EX4300-MP, and EX4400 switches allows an authenticated local attacker with no specific permissions to execute a privileged 'request' command, causing a complete traffic impact until automatic recovery.

A vulnerability in Juniper Junos OS on MX Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS) by continuously flapping Micro-BFD sessions. This overloads the PFEMAN process, preventing it from completing event processing, leading to watchdog timer expiry and FPC crash.

A NULL pointer dereference vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a local high-privileged attacker to set or deactivate a specific SSH configuration parameter, causing an mgd process crash and Denial of Service (DoS).

An OS Command Injection vulnerability in CLI processing of Juniper Networks Junos OS and Junos OS Evolved allows a local, high-privileged attacker to execute crafted CLI commands and inject arbitrary shell commands as root. Certain 'set system' commands are not properly sanitized.

An improper check for unusual or exceptional conditions vulnerability in the flow daemon (flowd) of Juniper Networks Junos OS on SRX Series allows an attacker to send a specific malformed ICMPv6 packet that crashes and restarts the srxpfe process. Continued receipt of such packets sustains a denial of service (DoS) condition. The issue occurs during NAT64 translation and cannot be triggered with IPv4 or other IPv6 traffic.

An improper check for unusual or exceptional conditions in the chassis control daemon (chassisd) of Junos OS on SRX1500, SRX4100, SRX4200 and SRX4600 allows a low-privileged local attacker to cause a complete DoS. Executing a specific 'show chassis' CLI command crashes and restarts chassisd, momentarily impacting all traffic.

An improper check for unusual or exceptional conditions in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1600, SRX2300 and SRX4300 allows a local attacker with low privileges to cause a complete Denial of Service (DoS). Executing a specific 'show chassis' CLI command crashes and restarts chassisd, momentarily impacting all traffic.

On Juniper Networks Junos OS EX4k and QFX5k devices configured as service-provider edge devices, with L2PT enabled on the UNI and VSTP enabled on the NNI in VXLAN scenarios, receiving VSTP BPDUs on the UNI leads to packet buffer allocation failures and the device stops passing traffic until manually restarted. Affects 24.4 releases before 24.4R2 and 25.2 releases before 25.2R1-S1 and 25.2R2.

In an EVPN-MPLS scenario, routes learned from remote multi-homed PE devices are programmed as ESI routes, and due to a logic issue in l2ald memory management, memory allocated for these routes is not released during churn, causing a memory leak that ultimately leads to a crash and restart of l2ald. Affects multiple Junos OS and Junos OS Evolved releases before specified fixed versions.

A vulnerability in J-Web of Juniper Networks Junos OS on SRX Series involves improper following of a certificate's chain of trust. When an SRX device is provisioned to connect to Security Director (SD) cloud, it does not sufficiently verify the received server certificate, allowing a PITM to intercept communication and access credentials.

A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local low-privileged user to read sensitive information. Executing the CLI command 'show mgd' with specific arguments exposes sensitive data.

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory available to bbe-smgd has been consumed, no new subscribers will be able to login. The memory utilization of bbe-smgd can be monitored with the following show command: user@host> show system processes extensive | match bbe-smgd. The below log message can be observed when this limit has been reached: bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion. This issue affects Junos OS on MX Series: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2, 25.2 versions before 25.2R2.

In Junos OS on MX Series with MPC10, MPC11, LC4800, LC9600 line cards and MX304, firewall filters applied to loopback interface lo0.n (where n is non-zero) are not executed when lo0.n is in the global VRF/default routing-instance. This allows an unauthenticated network-based attacker to bypass the configured firewall filter and access the device's control-plane.

An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks. When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked. This issue affects Junos OS on EX Series and QFX Series: 23.4 version 23.4R2-S6, 24.2 version 24.2R2-S3. No other Junos OS versions are affected.

An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service of the management plane. Rapidly establishing and disconnecting NETCONF sessions triggers a locking issue that causes mgd processes to hang in an unusable state, and once the maximum number of mgd processes is reached, no new logins are possible.

A Missing Authentication for Critical Function vulnerability in command processing of Juniper Networks Junos OS allows a privileged local attacker to gain access to Linux-based line cards as root. This affects systems with Linux-based line cards including various MPC, LC, MX, SRX, EX, and PTX models.

A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change. The policy mandating the password change is not enforced when the RADIUS server rejects a login due to an expired password.

A vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a denial-of-service (DoS). Receiving a specific BGP EVPN update message over an established BGP session causes rpd to crash and restart.

An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to get limited read-write access to files on the device. When the FTP server is enabled and a user named "ftp" or "anonymous" is configured, that user can login without providing the configured password and then has read-write access to their home directory.

A vulnerability in Junos OS on SRX4700 devices involves use of an uninitialized resource in the PFE, allowing an unauthenticated network-based attacker to cause an FPC crash and restart, leading to DoS. The issue occurs when forwarding-options sampling is enabled and traffic destined to the RE is processed by the PFE line card.

An access of uninitialized pointer vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved with BGP sharding configured allows an attacker triggering indirect next-hop updates to cause rpd to crash and restart, leading to a Denial of Service (DoS).

An Origin Validation Error vulnerability in an insufficiently protected file of Juniper Networks Junos OS on EX4600 Series and QFX5000 Series allows an unauthenticated attacker with physical access to the device to create a backdoor which allows complete control of the system. When a device isn't configured with a root password, an attacker can modify a specific file whose contents will be added to the Junos configuration without being visible, allowing the addition of any configuration unknown to the operator, including users and IP addresses. The exploit is persistent across reboots and even zeroization; the indicator of compromise is a modified /etc/config/<platform>-defaults[-flex].conf file.

A vulnerability in the SIP ALG of Junos OS on MX and SRX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS) by crashing flowd/mspmand when memory utilization is high and specific SIP packets are received. The system recovers automatically, but continuous attacks can cause a sustained DoS.