CVE-2024-21607

Technical Description

An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to cause partial impact to the integrity of the device.

If the "tcp-reset" option is added to the "reject" action in an IPv6 filter which matches on "payload-protocol", packets are permitted instead of rejected. This happens because the payload-protocol match criteria is not supported in the kernel filter causing it to accept all packets without taking any other action. As a fix the payload-protocol match will be treated the same as a "next-header" match to avoid this filter bypass.

This issue doesn't affect IPv4 firewall filters.

This issue affects Juniper Networks Junos OS on MX Series and EX9200 Series:

* All versions earlier than 20.4R3-S7;

* 21.1 versions earlier than 21.1R3-S5;

* 21.2 versions earlier than 21.2R3-S5;

* 21.3 versions earlier than 21.3R3-S4;

* 21.4 versions earlier than 21.4R3-S4;

* 22.

Remediation

Check the references section for vendor advisories and patches from juniper. Update junos to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References