Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-39534: Juniper Networks Junos OS Evolved: Unauthenticated Network Access

CVE-2024-39534 · published 2 years ago

Summary

A security flaw in Juniper Networks Junos OS Evolved allows an attacker on the same network to access the device and potentially bypass certain security controls. This could happen if an attacker uses the network and broadcast address of a subnet assigned to an interface. Affected versions of Junos OS Evolved should be updated to the latest version to prevent this issue.

What to do

Update juniper junos_os_evolved to version 21.4 or later.

Affected software

Vendor	Product	Affected versions
juniper	junos_os_evolved	< 21.4 21.4 22.2 22.3 22.4 23.2 23.4 `cpe:2.3:o:juniper:junos_os_evolved::::::::`

Original advisory text

An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface. This is unintended and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as stateless firewall filters.

This issue affects Junos OS Evolved:

* All versions before 21.4R3-S8-EVO,
* 22.2-EVO before 22.2R3-S4-EVO,
* 22.3-EVO before 22.3R3-S4-EVO,
* 22.4-EVO before 22.4R3-S3-EVO,
* 23.2-EVO before 23.2R2-S1-EVO,
* 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.

References

https://supportportal.juniper.net/JSA88105 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-697Incorrect Comparison

Timeline

Published11 Oct 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-39534 · NVD

Track software like this

Free during beta