CVE-2024-21607
published 2024-01-12CVE-2024-21607: An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to…
medium5.3CVSS 4.0
AVNACLPRNUINSUCNILAN
An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to cause partial impact to the integrity of the device.
If the "tcp-reset" option is added to the "reject" action in an IPv6 filter which matches on "payload-protocol", packets are permitted instead of rejected. This happens because the payload-protocol match criteria is not supported in the kernel filter causing it to accept all packets without taking any other action. As a fix the payload-protocol match will be treated the same as a "next-header" match to avoid this filter bypass.
This issue doesn't affect IPv4 firewall filters.
This issue affects Juniper Networks Junos OS on MX Series and EX9200 Series:
* All versions earlier than 20.4R3-S7;
* 21.1 versions earlier than 21.1R3-S5;
* 21.2 versions earlier than 21.2R3-S5;
* 21.3 versions earlier than 21.3R3-S4;
* 21.4 versions earlier than 21.4R3-S4;
* 22.1 versions earlier than 22.1R3-S2;
* 22.2 versions earlier than 22.2R3-S2;
* 22.3 versions earlier than 22.3R2-S2, 22.3R3;
* 22.4 versions earlier than 22.4R1-S2, 22.4R2-S2, 22.4R3.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | junos | < 20.4 | 20.4 |
| juniper | junos | < 21.2 | 21.2 |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper | mx_series | — | — |
| juniper_networks | junos_os | < 21.2R3-S9 | 21.2R3-S9 |
| juniper_networks | junos_os | >= 21.4 < 21.4R3-S11 | 21.4R3-S11 |
| juniper_networks | junos_os | >= 22.2 < 22.2R3-S7 | 22.2R3-S7 |
| juniper_networks | junos_os | >= 22.4 < 22.4R3-S7 | 22.4R3-S7 |
| juniper_networks | junos_os | >= 23.2 < 23.2R2-S4 | 23.2R2-S4 |
| juniper_networks | junos_os | >= 23.4 < 23.4R2-S5 | 23.4R2-S5 |
| juniper_networks | junos_os | >= 24.2 < 24.2R2-S1 | 24.2R2-S1 |
| juniper_networks | junos_os | >= 24.4 < 24.4R1-S2, 24.4R2 | 24.4R1-S2, 24.4R2 |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N