Read the docs
TI-2020-01632 Aliases CVE-2020-1685GHSA-8m64-wrm2-jj3m

Junos OS: EX4600, QFX5K Series: Stateless firewall filter matching 'user-vlan-id' will cause incomplete discard action

Priority LOW 27CWE-203Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-203.

Summary

When configuring stateless firewall filters in Juniper Networks EX4600 and QFX 5000 Series devices using Virtual Extensible LAN protocol (VXLAN), the discard action will fail to discard traffic under certain conditions. Given a firewall filter configuration similar to: family ethernet-switching { filter L2-VLAN { term ALLOW { from { user-vlan-id 100; } then { accept; } } term NON-MATCH { then { discard; } } when there is only one term containing a 'user-vlan-id' match condition, and no other terms in the firewall filter except discard, the discard action for non-matching traffic will only discard traffic with the same VLAN ID specified under 'user-vlan-id'. Other traffic (e.g. VLAN ID 200) will not be discarded. This unexpected behavior can lead to unintended traffic passing through the interface where the firewall filter is applied. This issue only affects systems using VXLANs. This issue affects Juniper Networks Junos OS on QFX5K Series: 18.1 versions prior to 18.1R3-S7, except 18.1R3; 18.2 versions prior to 18.2R2-S7, 18.2R3-S1; 18.3 versions prior to 18.3R1-S5, 18.3R2-S4, 18.3R3; 18.4 versions prior to 18.4R1-S7, 18.4R2-S1, 18.4R3; 19.1 versions prior to 19.1R1-S5, 19.1R2; 19.2 versions prior to 19.2R1-S5, 19.2R2.

Why it matters now

EPSS 0.0076 55th percentileScored 2026-11-07
Fix Fixed Junos OS (Juniper Networks): 18.1R3, 18.1R3-S7, 18.2R2-S7 +11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OS18.1 to before 18.1R3-S7; 18.2 to before 18.2R2-S7, 18.2R3-S1; 18.3 to before 18.3R1-S5, 18.3R2-S4, 18.3R3; 18.4 to before 18.4R1-S7, 18.4R2-S1, 18.4R3; 19.1 to before 19.1R1-S5, 19.1R2; 19.2 to before 19.2R1-S5, 19.2R218.1R3, 18.1R3-S7, 18.2R2-S7, 18.2R3-S1, 18.3R1-S5, 18.3R2-S4, 18.3R3, 18.4R1-S7, 18.4R2-S1, 18.4R3, 19.1R1-S5, 19.1R2, 19.2R1-S5, 19.2R2Patch availableCNA
  • Junos OS VendorJuniper Affected 18.1 to before 18.1R3-S7; 18.2 to before 18.2R2-S7, 18.2R3-S1; 18.3 to before 18.3R1-S5, 18.3R2-S4, 18.3R3; 18.4 to before 18.4R1-S7, 18.4R2-S1, 18.4R3; 19.1 to before 19.1R1-S5, 19.1R2; 19.2 to before 19.2R1-S5, 19.2R2 Fixed in 18.1R3, 18.1R3-S7, 18.2R2-S7, 18.2R3-S1, 18.3R1-S5, 18.3R2-S4, 18.3R3, 18.4R1-S7, 18.4R2-S1, 18.4R3, 19.1R1-S5, 19.1R2, 19.2R1-S5, 19.2R2 Patch available CNA

CPE configurations NVD · 64

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos:18.1:-:*:*:*:*:*:*18.1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r1:*:*:*:*:*:*18.1 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r2:*:*:*:*:*:*18.1 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r2-s1:*:*:*:*:*:*18.1 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r2-s2:*:*:*:*:*:*18.1 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r2-s4:*:*:*:*:*:*18.1 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r3:*:*:*:*:*:*18.1 r3VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r3-s1:*:*:*:*:*:*18.1 r3-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r3-s2:*:*:*:*:*:*18.1 r3-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r3-s3:*:*:*:*:*:*18.1 r3-s3VulnerableJuniper
  • cpe:2.3:o:juniper:junos:18.1:-:*:*:*:*:*:* Versions 18.1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r1:*:*:*:*:*:* Versions 18.1 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r2:*:*:*:*:*:* Versions 18.1 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r2-s1:*:*:*:*:*:* Versions 18.1 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r2-s2:*:*:*:*:*:* Versions 18.1 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r2-s4:*:*:*:*:*:* Versions 18.1 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r3:*:*:*:*:*:* Versions 18.1 r3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r3-s1:*:*:*:*:*:* Versions 18.1 r3-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r3-s2:*:*:*:*:*:* Versions 18.1 r3-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r3-s3:*:*:*:*:*:* Versions 18.1 r3-s3 Vulnerable ·Juniper
Show 54 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos:18.1:r3-s4:*:*:*:*:*:*18.1 r3-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:18.1:r3-s6:*:*:*:*:*:*18.1 r3-s6VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:-:*:*:*:*:*:*18.2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r1:*:*:*:*:*:*18.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r1:-:*:*:*:*:*18.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r1-s3:*:*:*:*:*:*18.2 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r1-s4:*:*:*:*:*:*18.2 r1-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r1-s5:*:*:*:*:*:*18.2 r1-s5VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r2:*:*:*:*:*:*18.2 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r2-s1:*:*:*:*:*:*18.2 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r2-s2:*:*:*:*:*:*18.2 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r2-s3:*:*:*:*:*:*18.2 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r2-s4:*:*:*:*:*:*18.2 r2-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r2-s5:*:*:*:*:*:*18.2 r2-s5VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r2-s6:*:*:*:*:*:*18.2 r2-s6VulnerableJuniper
cpe:2.3:o:juniper:junos:18.2:r3:*:*:*:*:*:*18.2 r3VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:-:*:*:*:*:*:*18.3VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r1:*:*:*:*:*:*18.3 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r1-s1:*:*:*:*:*:*18.3 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r1-s2:*:*:*:*:*:*18.3 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r1-s3:*:*:*:*:*:*18.3 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r1-s4:*:*:*:*:*:*18.3 r1-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r2:*:*:*:*:*:*18.3 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r2-s1:*:*:*:*:*:*18.3 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r2-s2:*:*:*:*:*:*18.3 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.3:r2-s3:*:*:*:*:*:*18.3 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:-:*:*:*:*:*:*18.4VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:r1:*:*:*:*:*:*18.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:r1-s1:*:*:*:*:*:*18.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:r1-s2:*:*:*:*:*:*18.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:r1-s3:*:*:*:*:*:*18.4 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:r1-s4:*:*:*:*:*:*18.4 r1-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:r1-s5:*:*:*:*:*:*18.4 r1-s5VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:r1-s6:*:*:*:*:*:*18.4 r1-s6VulnerableJuniper
cpe:2.3:o:juniper:junos:18.4:r2:*:*:*:*:*:*18.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos:19.1:-:*:*:*:*:*:*19.1VulnerableJuniper
cpe:2.3:o:juniper:junos:19.1:r1:*:*:*:*:*:*19.1 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:19.1:r1-s1:*:*:*:*:*:*19.1 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:19.1:r1-s2:*:*:*:*:*:*19.1 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:19.1:r1-s3:*:*:*:*:*:*19.1 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:19.1:r1-s4:*:*:*:*:*:*19.1 r1-s4VulnerableJuniper
cpe:2.3:o:juniper:junos:19.2:-:*:*:*:*:*:*19.2VulnerableJuniper
cpe:2.3:o:juniper:junos:19.2:r1:*:*:*:*:*:*19.2 r1VulnerableJuniper
cpe:2.3:o:juniper:junos:19.2:r1-s1:*:*:*:*:*:*19.2 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos:19.2:r1-s2:*:*:*:*:*:*19.2 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos:19.2:r1-s3:*:*:*:*:*:*19.2 r1-s3VulnerableJuniper
cpe:2.3:o:juniper:junos:19.2:r1-s4:*:*:*:*:*:*19.2 r1-s4VulnerableJuniper
cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:o:juniper:junos:18.1:r3-s4:*:*:*:*:*:* Versions 18.1 r3-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.1:r3-s6:*:*:*:*:*:* Versions 18.1 r3-s6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:-:*:*:*:*:*:* Versions 18.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r1:*:*:*:*:*:* Versions 18.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r1:-:*:*:*:*:* Versions 18.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r1-s3:*:*:*:*:*:* Versions 18.2 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r1-s4:*:*:*:*:*:* Versions 18.2 r1-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r1-s5:*:*:*:*:*:* Versions 18.2 r1-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r2:*:*:*:*:*:* Versions 18.2 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r2-s1:*:*:*:*:*:* Versions 18.2 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r2-s2:*:*:*:*:*:* Versions 18.2 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r2-s3:*:*:*:*:*:* Versions 18.2 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r2-s4:*:*:*:*:*:* Versions 18.2 r2-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r2-s5:*:*:*:*:*:* Versions 18.2 r2-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r2-s6:*:*:*:*:*:* Versions 18.2 r2-s6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.2:r3:*:*:*:*:*:* Versions 18.2 r3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:-:*:*:*:*:*:* Versions 18.3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r1:*:*:*:*:*:* Versions 18.3 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r1-s1:*:*:*:*:*:* Versions 18.3 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r1-s2:*:*:*:*:*:* Versions 18.3 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r1-s3:*:*:*:*:*:* Versions 18.3 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r1-s4:*:*:*:*:*:* Versions 18.3 r1-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r2:*:*:*:*:*:* Versions 18.3 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r2-s1:*:*:*:*:*:* Versions 18.3 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r2-s2:*:*:*:*:*:* Versions 18.3 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.3:r2-s3:*:*:*:*:*:* Versions 18.3 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:-:*:*:*:*:*:* Versions 18.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:r1:*:*:*:*:*:* Versions 18.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:r1-s1:*:*:*:*:*:* Versions 18.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:r1-s2:*:*:*:*:*:* Versions 18.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:r1-s3:*:*:*:*:*:* Versions 18.4 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:r1-s4:*:*:*:*:*:* Versions 18.4 r1-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:r1-s5:*:*:*:*:*:* Versions 18.4 r1-s5 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:r1-s6:*:*:*:*:*:* Versions 18.4 r1-s6 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:18.4:r2:*:*:*:*:*:* Versions 18.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.1:-:*:*:*:*:*:* Versions 19.1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.1:r1:*:*:*:*:*:* Versions 19.1 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.1:r1-s1:*:*:*:*:*:* Versions 19.1 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.1:r1-s2:*:*:*:*:*:* Versions 19.1 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.1:r1-s3:*:*:*:*:*:* Versions 19.1 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.1:r1-s4:*:*:*:*:*:* Versions 19.1 r1-s4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.2:-:*:*:*:*:*:* Versions 19.2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.2:r1:*:*:*:*:*:* Versions 19.2 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.2:r1-s1:*:*:*:*:*:* Versions 19.2 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.2:r1-s2:*:*:*:*:*:* Versions 19.2 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.2:r1-s3:*:*:*:*:*:* Versions 19.2 r1-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos:19.2:r1-s4:*:*:*:*:*:* Versions 19.2 r1-s4 Vulnerable ·Juniper
  • cpe:2.3:h:juniper:qfx5100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper

Remediation

  • Fix · CNA Junos OS (Juniper Networks) Fixed in 18.1R3, 18.1R3-S7, 18.2R2-S7, 18.2R3-S1, 18.3R1-S5, 18.3R2-S4, 18.3R3, 18.4R1-S7, 18.4R2-S1, 18.4R3, 19.1R1-S5, 19.1R2, 19.2R1-S5, 19.2R2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1685
  2. 2026-10-03 Alias added: GHSA-8m64-wrm2-jj3m

References

Advisory 1

  • TI-2023-18638 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-01585 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
  • TI-2025-15550 Junos OS: An local attacker with shell access can execute arbitrary code KEVCVSS 4.0MEDIUM 6.7
  • TI-2023-18644 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files KEVCVSS 3.1MEDIUM 5.3
  • TI-2023-18640 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files KEVCVSS 3.1MEDIUM 5.3
See all 792 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences