CVE-2023-0026 — Improper Input Validation in Networks Junos OS

CWE-20 — Improper Input Validation5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 70.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Juniper Networks Junos OSJuniper Networks Junos OS EvolvedJuniper Junos+1 more
Timeline
PublishedJun 21
Latest updateNov 14

Description

An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). When a BGP update message is received over an established BGP session, and that message contains a specific, optional transitive attribute, this session will be torn down with an update message error. This issue cannot propagate beyond an affected system as the processing error occur…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5juniper_networks/junos_os_evolvedunspecified — 20.4R3-S8-EVO+9
▶CVEListV5juniper_networks/junos_osunspecified — 20.4R3-S8+9
▶NVDjuniper/junos15.1 — 20.4+9

🔴Vulnerability Details

2
CVEList
2023-06: Out-of-Cycle Security Bulletin: Junos OS and Junos OS Evolved: A BGP session will flap upon receipt of a specific, optional transitive attribute↗2023-06-21
▶
GHSA
GHSA-fq52-pj3r-g45r: An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenti↗2023-06-21
▶

📋Vendor Advisories

2
VMware
VMware Cloud Director Appliance contains an authentication bypass vulnerability (CVE-2023-34060).↗2023-11-14
▶
Juniper
CVE-2023-0026: An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenti↗2023-06-21
▶
CVE-2023-0026 — Improper Input Validation | cvebase