CVE-2024-21591 — Out-of-bounds Write in Networks Junos OS

CWE-787 — Out-of-bounds Write5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
16.7%
top 5.06%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Juniper Networks Junos OSJuniper Junos
Timeline
PublishedJan 12

Description

An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device. This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory. This issue affects Juniper Networks Junos OS SRX Series and EX Series: * Junos OS versions earlier than 20.4R3-S9; * Junos OS 21.2…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5juniper_networks/junos_os21.2 — 21.2R3-S7+7
▶NVDjuniper/junos< 20.4+8

🔴Vulnerability Details

2
CVEList
Junos OS: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code Execution↗2024-01-12
▶
GHSA
GHSA-j7xq-gvq8-pr7m: An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attack↗2024-01-12
▶

📋Vendor Advisories

1
Juniper
CVE-2024-21591: An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attac↗2024-01-12
▶

🕵️Threat Intelligence

1
Bleepingcomputer
Juniper warns of critical RCE bug in its firewalls and switches↗2024-01-12
▶
CVE-2024-21591 — Out-of-bounds Write | cvebase