CVE-2023-44190

Junos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerability

State: Published
Severity: 6.1 Medium
Published: Oct 11, 2023
Updated: Sep 18, 2024
Reserved: Sep 26, 2023

Description

An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.

This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016:

* All versions prior to 21.4R3-S5-EVO; * 22.1 versions prior to 22.1R3-S4-EVO; * 22.2 versions 22.2R1-EVO and later; * 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO; * 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO; * 23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L	juniper

Weaknesses

CWE-346 Origin Validation Error

Affected Products

Product	Versions
Junos OS EvolvedJuniper Networks	before 21.4R3-S5-EVOAffected 22.1 to before 22.1R3-S4-EVOAffected 22.2R1-EVO to before 22.2*-EVOAffected 22.3 to before 22.3R2-S2-EVO, 22.3R3-S1-EVOAffected 22.4 to before 22.4R2-S1-EVO, 22.4R3-EVOAffected 23.2 to before 23.2R1-S1-EVO, 23.2R2-EVOAffected

References

https://supportportal.juniper.net/JSA73154vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.