Skip to content
Fencer Vulns
medium 6.5

CVE-2024-39537 json

Junos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the network

published 2024-07-11 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-38063

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits
0
none known

Summary

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device.

Due to a wrong initialization, specific processes which should only be able to communicate internally within the device can be reached over the network via open ports.

This issue affects Junos OS Evolved on ACX 7000 Series:

* All versions before 21.4R3-S7-EVO, * 22.2-EVO

versions

before 22.2R3-S4-EVO, * 22.3-EVO versions before 22.3R3-S3-EVO, * 22.4-EVO versions before 22.4R3-S2-EVO, * 23.2-EVO versions before 23.2R2-EVO, * 23.4-EVO versions before 23.4R1-S1-EVO, 23.4R2-EVO.

Patch / fix

  • Juniper Networks Junos OS Evolved 21.4R3-S7-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R3-S2-EVO, 23.2R2-EVO, 23.4R1-S1-EVO, 23.4R2-EVO
  • juniper junos_os_evolved 21.4r3-s7, 22.2r3-s4, 22.3r3-s3, 22.4r3-s2, 23.2r2, 23.4r1-s1, 23.4r2

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Juniper Networks Junos OS Evolved
  • juniper junos_os_evolved

Classification

Weakness
  • CWE-923 Improper Restriction of Communication Channel to Intended Endpoints

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.