Skip to content
Fencer Vulns
high 7.5

CVE-2024-21586 json

Junos OS: SRX Series and NFX Series: Specific valid traffic leads to a PFE crash

published 2024-07-01 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-19234

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series and NFX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).

If an affected device receives specific valid traffic destined to the device, it will cause the PFE to crash and restart. Continued receipt and processing of this traffic will create a sustained DoS condition.

This issue affects Junos OS on SRX Series:

* 21.4 versions before 21.4R3-S7.9, * 22.1 versions before 22.1R3-S5.3, * 22.2 versions before 22.2R3-S4.11, * 22.3 versions before 22.3R3, * 22.4 versions before 22.4R3.

This issue affects Junos OS on NFX Series:

* 21.4 versions before 21.4R3-S8, * 22.1 versions after 22.1R1, * 22.2 versions before 22.2R3-S5, * 22.3 versions before 22.3R3, * 22.4 versions before 22.4R3.

Junos OS versions prior to 21.4R1 are not affected by this issue.

Patch / fix

  • Juniper Networks Junos OS 21.4R3-S7.9, 21.4R3-S8, 22.1R3-S5.3, 22.2R3-S4.11, 22.2R3-S5, 22.3R3, 22.4R3
  • juniper junos 21.4r1, 21.4r3-s7.9, 22.1r3-s5.3, 22.2r3-s4.11, 22.3r3, 22.4r3

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Juniper Networks Junos OS
  • juniper junos

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.