CVE-2024-39534

Description

An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface. This is unintended and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as stateless firewall filters. This issue affects Junos OS Evolved:  * All versions before 21.4R3-S8-EVO,  * 22.2-EVO before 22.2R3-S4-EVO,  * 22.3-EVO before 22.3R3-S4-EVO,  * 22.4-EVO before 22.4R3-S3-EVO,  * 23.2-EVO before 23.2R2-S1-EVO,  * 23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.

Reserved 2024-06-25 | Published 2024-10-11 | Updated 2024-10-11 | Assigner juniper

Problem types

CWE-697 Incorrect Comparison

Product status

Default status
unaffected

Any version before 21.4R3-S8-EVO
affected

22.2-EVO before 22.2R3-S4-EVO
affected

22.3-EVO before 22.3R3-S4-EVO
affected

22.4-EVO before 22.4R3-S3-EVO
affected

23.2-EVO before 23.2R2-S1-EVO
affected

23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO
affected

References

supportportal.juniper.net/JSA88105 vendor-advisory

cve.org (CVE-2024-39534)

nvd.nist.gov (CVE-2024-39534)

Download JSON