8.7

CVE-2024-39531

An Improper Handling of Values vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series allows a network-based, unauthenticated attacker to cause a Denial-of-Service (DoS).

If a value is configured for DDoS bandwidth or burst parameters for any protocol in
a queue, all protocols which share the same queue will have
their bandwidth or burst value changed to the new value. If, for example, OSPF was configured with a certain bandwidth value, ISIS would also be limited to this value. So inadvertently either the control plane is open for a high level of specific traffic which was supposed to be limited to a lower value, or the limit for a certain protocol is so low that chances to succeed with a volumetric DoS attack are significantly increased. 




This issue affects Junos OS Evolved on ACX 7000 Series:



  *  All versions before 21.4R3-S7-EVO,
  *  22.1 versions before 22.1R3-S6-EVO, 
  *  22.2 versions before 22.2R3-S3-EVO,
  *  22.3 versions before 22.3R3-S3-EVO, 
  *  22.4 versions before 22.4R3-S2-EVO,
  *  23.2 versions before 23.2R2-EVO,
  *  23.4 

versions 

before 23.4R1-S1-EVO, 23.4R2-EVO.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Vendorjuniper
≫
Product junos_os_evolved
Default Statusunknown
Version < 21.4R3-S7-EVO
Version 0
Status affected
Version < 22.1R3-S6-EVO
Version 22.1
Status affected
Version < 22.2R3-S3-EVO
Version 22.2
Status affected
Version < 22.3R3-S3-EVO
Version 22.3
Status affected
Version < 22.4R3-S2-EVO
Version 22.4
Status affected
Version < 23.2R2-EVO
Version 23.2
Status affected
Version < 23.4R1-S1-EVO
Version 23.4
Status affected
Version < 23.4R2-EVO
Version 23.4
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.25% 0.485
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
sirt@juniper.net 8.7 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
sirt@juniper.net 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-229 Improper Handling of Values

The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.