#VU98393 Incorrect comparison in Junos OS Evolved - CVE-2024-39534

Vulnerability identifier: #VU98393

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-39534

CWE-ID: CWE-697

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Junos OS Evolved
Operating systems & Components / Operating system

Vendor: Juniper Networks, Inc.

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to  incorrect comparison error in the local address verification API. A remote non-authenticated attacker can create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Junos OS Evolved: 21.4R1-EVO - 21.4R3-S7-EVO, 22.2-EVO - 22.2R3-S3-EVO, 22.3R1-EVO - 22.3R3-S3-EVO

---

External links
https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-Evolved-Connections-to-the-network-and-broadcast-address-accepted-CVE-2024-39534

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.