Unimplemented or Unsupported Feature in UI in Junos OS Evolved - CVE-2024-47498
Published: October 10, 2024
Vulnerability identifier: #VU98350
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-47498
CWE-ID: CWE-447
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to incorrect implementation of the MAC learning and moves feature. Several configuration statements meant to enforce limits on MAC learning and moves can be configured but do not take effect. This can lead to control plane overload situations which will severely impact the ability of the device to processes legitimate traffic. A remote attacker on the local network can perform a denial of service (DoS) attack.
The vulnerability affects QFX5000 Series routers.
Affected software
Junos OS Evolved
How to mitigate CVE-2024-47498
Install updates from vendor's website.
Junos OS Evolved - addressed in versions 21.4R3-S8-EVO, 22.2R3-S5-EVO, 22.4R3-EVO, 23.2R2-EVO, 23.4R1-EVO