Junos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the network (Juniper Networks Junos OS Evolved)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.33 % · percentile 26 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- juniper
- NVD status
- Analyzed
Description
An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, specific processes which should only be able to communicate internally within the device can be reached over the network via open ports. This issue affects Junos OS Evolved on ACX 7000 Series: * All versions before 21.4R3-S7-EVO, * 22.2-EVO versions before 22.2R3-S4-EVO, * 22.3-EVO versions before 22.3R3-S3-EVO, * 22.4-EVO versions before 22.4R3-S2-EVO, * 23.2-EVO versions before 23.2R2-EVO, * 23.4-EVO versions before 23.4R1-S1-EVO, 23.4R2-EVO.
Weaknesses (CWE)
- CWE-923 — Improper Restriction of Communication Channel to Intended Endpoints
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L | juniper |
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N | juniper |
| CVSS 4.0 | MEDIUM 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · sirt@juniper.net (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L | NVD · sirt@juniper.net (Secondary) |
European references
- ENISA EUVD · EUVD-2024-38063
- GCVE · GCVE-0-2024-39537
CERT-FR advisories
- CERTFR-2024-AVI-0575 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*< 21.4cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s4:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s5:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s6:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.2:r3-s3:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r2-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r2-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r3:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r3-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.3:r3-s2:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.4:-:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.4:r1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s1:*:*:*:*:*:*cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s2:*:*:*:*:*:*- +12 more
Affected products
| Product | Versions |
|---|---|
| Juniper Networks · Junos OS Evolved | affected 0 < 21.4R3-S7-EVO ; affected 22.2-EVO < 22.2R3-S4-EVO ; affected 22.3-EVO < 22.3R3-S3-EVO ; affected 22.4-EVO < 22.4R3-S2-EVO ; affected 23.2-EVO < 23.2R2-EVO ; affected 23.4-EVO < 23.4R1-S1-EVO, 23.4R2-EVO |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |