CVE-2024-21593 — MEDIUM (6.5)

Vulnerability Description

An Improper Check or Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). If an attacker sends a specific MPLS packet, which upon processing, causes an internal loop, that leads to a PFE crash and restart. Continued receipt of these packets leads to a sustained Denial of Service (DoS) condition. Circuit cross-connect (CCC) needs to be configured on the device for it to be affected by this issue. This issue only affects MX Series with MPC10, MPC11, LC9600, and MX304. This issue affects: Juniper Networks Junos OS 21.4 versions from 21.4R3 earlier than 21.4R3-S5; 22.2 versions from 22.2R2 earlier than 22.2R3-S2; 22.3 versions from 22.3R1 earlier than 22.3R2-S2; 22.3 versions from 22.3R3 earlier than 22.3R3-S1 22.4 versions from 22.4R1 earlier than 22.4R2-S2, 22.4R3; 23.2 versions earlier than 23.2R1-S1, 23.2R2.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Juniper	Junos	21.4
Juniper	Lc9600	-
Juniper	Mpc10	-
Juniper	Mpc11	-
Juniper	Mx10004	-
Juniper	Mx10008	-
Juniper	Mx2008	-
Juniper	Mx2010	-
Juniper	Mx2020	-
Juniper	Mx204	-
Juniper	Mx240	-
Juniper	Mx304	-
Juniper	Mx480	-
Juniper	Mx960	-

Related Weaknesses (CWE)

CWE-703

References

https://supportportal.juniper.net/JSA75732Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:NTechnical Description
https://supportportal.juniper.net/JSA75732Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:NTechnical Description

FAQ

What is CVE-2024-21593?

CVE-2024-21593 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An Improper Check or Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attack...

How severe is CVE-2024-21593?

CVE-2024-21593 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-21593?

Check the references section above for vendor advisories and patch information. Affected products include: Juniper Junos, Juniper Lc9600, Juniper Mpc10, Juniper Mpc11, Juniper Mx10004.