Read the docs
TI-2022-06525 Aliases CVE-2022-22192GHSA-pgf8-mcvj-26jv

Junos OS Evolved: PTX Series: An attacker can cause a kernel panic by sending a malformed TCP packet to the device

Priority MEDIUM 40CWE-1286Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An Improper Validation of Syntactic Correctness of Input vulnerability in the kernel of Juniper Networks Junos OS Evolved on PTX series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). When an incoming TCP packet destined to the device is malformed there is a possibility of a kernel panic. Only TCP packets destined to the ports for BGP, LDP and MSDP can trigger this. This issue only affects PTX10004, PTX10008, PTX10016. No other PTX Series devices or other platforms are affected. This issue affects Juniper Networks Junos OS Evolved: 20.4-EVO versions prior to 20.4R3-S4-EVO; 21.3-EVO versions prior to 21.3R3-EVO; 21.4-EVO versions prior to 21.4R3-EVO; 22.1-EVO versions prior to 22.1R2-EVO. This issue does not affect Juniper Networks Junos OS Evolved versions prior to 20.4R1-EVO.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00844 58th percentileScored 2026-11-07
Fix Fixed Junos OS Evolved (Juniper Networks): 20.4R3-S4-EVO, 21.3R3-EVO, 21.4R3-EVO +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JuniperJunos OS Evolved20.4-EVO to before 20.4R3-S4-EVO; 21.3-EVO to before 21.3R3-EVO; 21.4-EVO to before 21.4R3-EVO; 22.1-EVO to before 22.1R2-EVO20.4R3-S4-EVO, 21.3R3-EVO, 21.4R3-EVO, 22.1R2-EVOPatch availableCNA
  • Junos OS Evolved VendorJuniper Affected 20.4-EVO to before 20.4R3-S4-EVO; 21.3-EVO to before 21.3R3-EVO; 21.4-EVO to before 21.4R3-EVO; 22.1-EVO to before 22.1R2-EVO Fixed in 20.4R3-S4-EVO, 21.3R3-EVO, 21.4R3-EVO, 22.1R2-EVO Patch available CNA

CPE configurations NVD · 28

CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos_os_evolved:20.4:r1:*:*:*:*:*:*20.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s1:*:*:*:*:*:*20.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s2:*:*:*:*:*:*20.4 r1-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r2:*:*:*:*:*:*20.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s1:*:*:*:*:*:*20.4 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s2:*:*:*:*:*:*20.4 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s3:*:*:*:*:*:*20.4 r2-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r3:*:*:*:*:*:*20.4 r3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s1:*:*:*:*:*:*20.4 r3-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s2:*:*:*:*:*:*20.4 r3-s2VulnerableJuniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r1:*:*:*:*:*:* Versions 20.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s1:*:*:*:*:*:* Versions 20.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r1-s2:*:*:*:*:*:* Versions 20.4 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r2:*:*:*:*:*:* Versions 20.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s1:*:*:*:*:*:* Versions 20.4 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s2:*:*:*:*:*:* Versions 20.4 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r2-s3:*:*:*:*:*:* Versions 20.4 r2-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r3:*:*:*:*:*:* Versions 20.4 r3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s1:*:*:*:*:*:* Versions 20.4 r3-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s2:*:*:*:*:*:* Versions 20.4 r3-s2 Vulnerable ·Juniper
Show 18 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s3:*:*:*:*:*:*20.4 r3-s3VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.3:r1:*:*:*:*:*:*21.3 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.3:r1-s1:*:*:*:*:*:*21.3 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.3:r2:*:*:*:*:*:*21.3 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.3:r2-s1:*:*:*:*:*:*21.3 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.3:r2-s2:*:*:*:*:*:*21.3 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:*21.4VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.4:r1:*:*:*:*:*:*21.4 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1:*:*:*:*:*:*21.4 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.4:r2:*:*:*:*:*:*21.4 r2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s1:*:*:*:*:*:*21.4 r2-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s2:*:*:*:*:*:*21.4 r2-s2VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:22.1:r1:*:*:*:*:*:*22.1 r1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s1:*:*:*:*:*:*22.1 r1-s1VulnerableJuniper
cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s2:*:*:*:*:*:*22.1 r1-s2VulnerableJuniper
cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:*not specified by NVDRunning onJuniper
  • cpe:2.3:o:juniper:junos_os_evolved:20.4:r3-s3:*:*:*:*:*:* Versions 20.4 r3-s3 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.3:r1:*:*:*:*:*:* Versions 21.3 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.3:r1-s1:*:*:*:*:*:* Versions 21.3 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.3:r2:*:*:*:*:*:* Versions 21.3 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.3:r2-s1:*:*:*:*:*:* Versions 21.3 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.3:r2-s2:*:*:*:*:*:* Versions 21.3 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:* Versions 21.4 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.4:r1:*:*:*:*:*:* Versions 21.4 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1:*:*:*:*:*:* Versions 21.4 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.4:r2:*:*:*:*:*:* Versions 21.4 r2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s1:*:*:*:*:*:* Versions 21.4 r2-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s2:*:*:*:*:*:* Versions 21.4 r2-s2 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:22.1:r1:*:*:*:*:*:* Versions 22.1 r1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s1:*:*:*:*:*:* Versions 22.1 r1-s1 Vulnerable ·Juniper
  • cpe:2.3:o:juniper:junos_os_evolved:22.1:r1-s2:*:*:*:*:*:* Versions 22.1 r1-s2 Vulnerable ·Juniper
  • cpe:2.3:h:juniper:ptx10004:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ptx10008:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
  • cpe:2.3:h:juniper:ptx10016:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper

Remediation

  • Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 20.4R3-S4-EVO, 21.3R3-EVO, 21.4R3-EVO, 22.1R2-EVO

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-22192
  2. 2026-10-03 Alias added: GHSA-pgf8-mcvj-26jv

References

Advisory 1

  • TI-2026-17602 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root CVSS 4.0CRITICAL 9.3
  • TI-2026-17601 Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash CVSS 4.0MEDIUM 6.7
  • TI-2023-04136 Improper input validation in Juniper Junos OS CVSS 3.1HIGH 7.5
  • TI-2026-74215 Stack-based buffer overflow in Junos OS rpd triggered by BGP peers CVSS 4.0CRITICAL 9.3
  • TI-2026-74211 Authentication bypass in Juniper J-Web allows pre-auth CGI execution CVSS 4.0CRITICAL 9.3
  • TI-2021-00146 Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted. CVSS 3.1CRITICAL 10.0
See all 249 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences