Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2024-21605 |
CWE-ID | CWE-668 |
Exploitation vector | Local network |
Public exploit | N/A |
Vulnerable software Subscribe |
Juniper Junos OS Operating systems & Components / Operating system |
Vendor | Juniper Networks, Inc. |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU88450
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-21605
CWE-ID:
CWE-668 - Exposure of resource to wrong sphere
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to exposure of resource to wrong sphere error in the Packet Forwarding Engine (PFE). A remote non-authenticated attacker can cause a Denial of Service (DoS).
Specific valid link-local traffic is not blocked on ports in STP blocked state but is instead sent to the control plane of the device.
This leads to excessive resource consumption and in turn severe impact on all control and management protocols of the device.
MitigationInstall updates from vendor's website.
Vulnerable software versionsJuniper Junos OS: 21.2R1 - 23.4R1-S1
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.