TI-2024-20133 Aliases CVE-2024-30403 GHSA-hxmw-j74g-j23w

Junos OS Evolved: When MAC learning happens, and an interface gets flapped, the PFE crashes

LOW 31CWE-476Published 2024-04-12 · Updated 2024-08-02

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-476.

Summary

A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When Layer 2 traffic is sent through a logical interface, MAC learning happens. If during this process, the interface flaps, an Advanced Forwarding Toolkit manager (evo-aftmand-bt) core is observed. This leads to a PFE restart. The crash reoccurs if the same sequence of events happens, which will lead to a sustained DoS condition. This issue affects Juniper Networks Junos OS Evolved 23.2-EVO versions earlier than 23.2R1-S1-EVO, 23.2R2-EVO.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00276 20th percentileScored 2026-11-07

Fix Fixed Junos OS Evolved (Juniper Networks): 23.2R1-S1-EVO, 23.2R2-EVO

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Juniper	Junos OS Evolved	23.2-EVO to before 23.2R1-S1-EVO, 23.2R2-EVO	23.2R1-S1-EVO, 23.2R2-EVO	Patch available	CNA

Junos OS Evolved VendorJuniper Affected 23.2-EVO to before 23.2R1-S1-EVO, 23.2R2-EVO Fixed in 23.2R1-S1-EVO, 23.2R2-EVO Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:juniper:junos_os_evolved:23.2:-::::::	23.2	Vulnerable	Juniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1::::::	23.2 r1	Vulnerable	Juniper

cpe:2.3:o:juniper:junos_os_evolved:23.2:-:*:*:*:*:*:* Versions 23.2 Vulnerable ·Juniper
cpe:2.3:o:juniper:junos_os_evolved:23.2:r1:*:*:*:*:*:* Versions 23.2 r1 Vulnerable ·Juniper

Remediation

Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 23.2R1-S1-EVO, 23.2R2-EVO

Timeline

2026-10-02 Threatist record created from CVE-2024-30403
2026-10-03 Alias added: GHSA-hxmw-j74g-j23w

References

Advisory 1

https://supportportal.juniper.net/JSA79181

Other 1

https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

TI-2026-17602 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root CVSS 4.0CRITICAL 9.3
TI-2026-17601 Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash CVSS 4.0MEDIUM 6.7
TI-2023-04136 Improper input validation in Juniper Junos OS CVSS 3.1HIGH 7.5
TI-2026-74215 Stack-based buffer overflow in Junos OS rpd triggered by BGP peers CVSS 4.0CRITICAL 9.3
TI-2026-74211 Authentication bypass in Juniper J-Web allows pre-auth CGI execution CVSS 4.0CRITICAL 9.3
TI-2021-00146 Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted. CVSS 3.1CRITICAL 10.0

See all 249 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences