Read the docs
TI-2019-00008 Aliases CVE-2019-0008GHSA-w8p6-5qfp-c66p

QFX5000 Series, EX4300, EX4600: A stack buffer overflow vulnerability in Packet Forwarding Engine manager (FXPC) process

Priority MEDIUM 49CWE-121Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. Affected releases are Juniper Networks Junos OS on QFX 5000 series, EX4300, EX4600 are: 14.1X53; 15.1X53 versions prior to 15.1X53-D235; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2, 17.3R4; 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1, 18.1R4; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2.

Why it matters now

EPSS 0.04545 91st percentileScored 2026-11-07
Fix Fixed Junos OS (Juniper Networks): 15.1X53-D235, 17.1R3, 18.1R3-S1 +9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OS14.1X53; 15.1X53 to before 15.1X53-D235; 17.1 to before 17.1R3; 18.1 to before 18.1R3-S1, 18.1R4; 18.2 to before 18.2R2; 18.3 to before 18.3R215.1X53-D235, 17.1R3, 18.1R3-S1, 18.1R4, 18.2R2, 18.3R2Patch availableCNA
JuniperJunos OS17.2 to before 17.2R3; 17.3 to before 17.3R3-S2, 17.3R4; 17.4 to before 17.4R2-S1, 17.4R317.2R3, 17.3R3-S2, 17.3R4, 17.4R2-S1, 17.4R3Patch availableCNA
JuniperJunos OS18.2X75 to before 18.2X75-D3018.2X75-D30Patch availableCNA
  • Junos OS VendorJuniper Affected 14.1X53; 15.1X53 to before 15.1X53-D235; 17.1 to before 17.1R3; 18.1 to before 18.1R3-S1, 18.1R4; 18.2 to before 18.2R2; 18.3 to before 18.3R2 Fixed in 15.1X53-D235, 17.1R3, 18.1R3-S1, 18.1R4, 18.2R2, 18.3R2 Patch available CNA
  • Junos OS VendorJuniper Affected 17.2 to before 17.2R3; 17.3 to before 17.3R3-S2, 17.3R4; 17.4 to before 17.4R2-S1, 17.4R3 Fixed in 17.2R3, 17.3R3-S2, 17.3R4, 17.4R2-S1, 17.4R3 Patch available CNA
  • Junos OS VendorJuniper Affected 18.2X75 to before 18.2X75-D30 Fixed in 18.2X75-D30 Patch available CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*15.1x53 to before 15.1x53-d235; 17.1 to before 17.1r3; 17.2 to before 17.2r3; 17.3 to before 17.3r3-s2; 17.4 to before 17.4r2-s1; 18.1 to before 18.1r3-s1; 18.2 to before 18.2r2; 18.2x75 to before 18.2x75-d30; 18.3 to before 18.3r2VulnerableJuniper
cpe:2.3:o:juniper:junos:14.1x53:*:*:*:*:*:*:*14.1x53VulnerableJuniper
cpe:2.3:o:juniper:junos:17.3:*:*:*:*:*:*:*17.3VulnerableJuniper
cpe:2.3:o:juniper:junos:17.4:*:*:*:*:*:*:*17.4VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:*:*:*:*:*:*:*18.1VulnerableJuniper
cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4300m:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* Versions 15.1x53 to before 15.1x53-d235; 17.1 to before 17.1r3; 17.2 to before 17.2r3; 17.3 to before 17.3r3-s2; 17.4 to before 17.4r2-s1; 18.1 to before 18.1r3-s1; 18.2 to before 18.2r2; 18.2x75 to before 18.2x75-d30; 18.3 to before 18.3r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:14.1x53:*:*:*:*:*:*:* Versions 14.1x53 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:17.3:*:*:*:*:*:*:* Versions 17.3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:17.4:*:*:*:*:*:*:* Versions 17.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Juniper
  • cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4300m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5200-32c:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5200-48y:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5210-64c:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5200-32c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5200-48y:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5210-64c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper

Remediation

  • Fix · CNA Junos OS (Juniper Networks) Fixed in 15.1X53-D235, 17.1R3, 18.1R3-S1, 18.1R4, 18.2R2, 18.3R2
  • Fix · CNA Junos OS (Juniper Networks) Fixed in 17.2R3, 17.3R3-S2, 17.3R4, 17.4R2-S1, 17.4R3
  • Fix · CNA Junos OS (Juniper Networks) Fixed in 18.2X75-D30

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0008
  2. 2026-10-03 Alias added: GHSA-w8p6-5qfp-c66p

References

Advisory 1

  • TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
  • TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
  • TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
See all 792 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences