CVE-2024-21607

Summary

CVE-2024-21607 is a vulnerability affecting Juniper Networks Junos OS on MX Series and EX9200 Series. An unsupported feature in the UI allows unauthenticated, network-based attackers to bypass a filter and cause partial impact to the integrity of the device. Specifically, adding the "tcp-reset" option to the "reject" action in an IPv6 filter that matches on "payload-protocol" permits packets instead of rejecting them due to the unsupported payload-protocol match criteria in the kernel filter. This issue only impacts IPv6 firewall filters and does not affect IPv4 filters. Affected versions include all releases earlier than 20.4R3-S7, 21.1 versions earlier than 21.1R3-S5, 21.2 versions earlier than 21.2R3-S5, 21.3 versions earlier than 21.3R3-S4, 21.4 versions earlier than 21.4R3-S4, 22.1 versions earlier than 22.1R3-S2, 22.2 versions earlier than 22.2R3-S2, 22.3 versions earlier than 22.3R2-S2, 22.3R3, 22.4 versions earlier than 22.4R1-S2, 22.4R2-S2, and 22.4R3. A fix for this issue is to treat the payload-protocol match the same as a "next-header" match to avoid the filter bypass.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.