Vulnerability in Juniper Junos
CVE-2024-47504
An Improper Validation of Specified Type of Input vulnerability in the packet forwarding engine (pfe) Juniper Networks Junos OS on SRX5000 Series allows an unauthenticated, network based attacker to cause a Denial of Service (Dos). When a non-clustered SRX5000 device receives a specifically malformed packet this will cause a flowd crash and restart. This issue affects Junos OS: * 22.1 releases 22.1R1 and later before 22.2R3-S5, * 22.3 releases before 22.3R3-S4, * 22.4 releases before 22.4R3-S4, * 23.2 releases before 23.2R2-S2, * 23.4 releases before 23.4R2-S1, * 24.2 releases before 24.2R1-S1, 24.2R2. Please note that the PR does indicate that earlier versions have been fixed as well, but these won't be adversely impacted by this.
EPSS: 0.006 (46.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Juniper Junos — versions 22.1, 22.3, 22.4
- Juniper Srx5400
- Juniper Srx5600
- Juniper Srx5800
- Juniper Networks Junos Os — versions 22.2, 22.3, 22.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- sirt@juniper.net (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-47504?
- CVE-2024-47504 is a high-severity vulnerability in Juniper Junos, classified under CWE-1287. CVSS score: 7.5/10. Published 2024-10-11.
- How severe is CVE-2024-47504?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-47504 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.