Riskcovery

CVE-2024-39534

Junos OS Evolved: Connections to the network and broadcast address accepted

State
Published
Severity
5.3 Medium
Published
Oct 11, 2024
Updated
Oct 11, 2024
Reserved
Jun 25, 2024

Read the record on cve.org

Description

An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface. This is unintended and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as stateless firewall filters.

This issue affects Junos OS Evolved:

* All versions before 21.4R3-S8-EVO,  * 22.2-EVO before 22.2R3-S4-EVO,  * 22.3-EVO before 22.3R3-S4-EVO,  * 22.4-EVO before 22.4R3-S3-EVO,  * 23.2-EVO before 23.2R2-S1-EVO,  * 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:Njuniper
3.15.4 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Njuniper

Weaknesses

Affected Products

ProductVersions
Junos OS EvolvedJuniper Networks
  • before 21.4R3-S8-EVOAffected
  • 22.2-EVO to before 22.2R3-S4-EVOAffected
  • 22.3-EVO to before 22.3R3-S4-EVOAffected
  • 22.4-EVO to before 22.4R3-S3-EVOAffected
  • 23.2-EVO to before 23.2R2-S1-EVOAffected
  • 23.4-EVO to before 23.4R1-S2-EVO, 23.4R2-EVOAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.