CVE-2026-33774

published 2026-04-09

CVE-2026-33774: An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an…

medium 6.9 CVSS 4.0

AV N AC L AT N PR N UI N VC L VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU Y R U V X RE L U X

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the configured firewall filter and access the control-plane of the device.

On MX platforms with

MPC10, MPC11, LC4800 or LC9600

line cards, and MX304, firewall filters applied on a loopback interface lo0.n (where n is a non-0 number) don't get executed when lo0.n is in the global VRF / default routing-instance.

An affected configuration would be:

user@host# show configuration interfaces lo0 | display set
set interfaces lo0 unit 1 family inet filter input

where a firewall filter is applied to a non-0 loopback interface, but that loopback interface is not referred to in any routing-instance (RI) configuration, which implies that it's used in the default RI.

The issue can be observed with the CLI command:

user@device> show firewall counter filter

not showing any matches.

This issue affects Junos OS on MX Series:

* all versions before 23.2R2-S6,
* 23.4 versions before 23.4R2-S7,
* 24.2 versions before 24.2R2,
* 24.4 versions before 24.4R2.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
juniper	junos_os	—	—
juniper	mx_series	—	—
juniper_networks	junos_os	< 23.2R2-S6	23.2R2-S6
juniper_networks	junos_os	>= 23.4 < 23.4R2-S7	23.4R2-S7
juniper_networks	junos_os	>= 24.2 < 24.2R2	24.2R2
juniper_networks	junos_os	>= 24.4 < 24.4R2	24.4R2

CWE-754