Juniper Junos OS Evo Local Addr API Vulnerability Pre-21.4R3
CVE-2024-39534 Published on October 11, 2024
Junos OS Evolved: Connections to the network and broadcast address accepted
An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface. This is unintended and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as stateless firewall filters.
This issue affects Junos OS Evolved:
* All versions before 21.4R3-S8-EVO,
* 22.2-EVO before 22.2R3-S4-EVO,
* 22.3-EVO before 22.3R3-S4-EVO,
* 22.4-EVO before 22.4R3-S3-EVO,
* 23.2-EVO before 23.2R2-S1-EVO,
* 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.
Vulnerability Analysis
Weakness Type
Incorrect Comparison
The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Products Associated with CVE-2024-39534
Want to know whenever a new CVE is published for Juniper Networks Junos Os Evolved? stack.watch will email you.
Affected Versions
Juniper Networks Junos OS Evolved:- Before 21.4R3-S8-EVO is affected.
- Version 22.2-EVO and below 22.2R3-S4-EVO is affected.
- Version 22.3-EVO and below 22.3R3-S4-EVO is affected.
- Version 22.4-EVO and below 22.4R3-S3-EVO is affected.
- Version 23.2-EVO and below 23.2R2-S1-EVO is affected.
- Version 23.4-EVO and below 23.4R1-S2-EVO, 23.4R2-EVO is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.