Junos OS: EX2300 and EX3400 series: Certain stateless firewall filter rules might not take effect

published 2019-01-15 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-0809

cvss: 5.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.4%; EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits: 0; none known

On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs, the output of the command: show pfe filter hw summary will not show the entry for: RACL group Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2. This issue affect both IPv4 and IPv6 firewall filter.

Patch / fix

fixed in 1

Juniper Networks Junos OS 15.1X53-D590, 18.1R3, 18.2R2

Exploit prediction

2.38% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	5.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

Juniper Networks Junos OS

Classification

Weakness

CWE-794 Incomplete Filtering of Multiple Instances of Special Elements

References

juniper.net /documentation/en_US/junos/topics/reference/command-summary/show-pfe-filter.html
vendor-advisory
kb.juniper.net /JSA10901
vendor-advisory
securityfocus.com /bid/106669
vdb-entry, third-party-advisory

Sources

CVE List CVE-2019-0002
NVD CVE-2019-0002

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary