TI-2024-26453 Aliases CVE-2024-39519 GHSA-cr76-625x-q34w

Junos OS Evolved: ACX 7000 Series: Multicast traffic is looped in a multihoming EVPN MPLS scenario

LOW 31CWE-754Published 2024-07-11 · Updated 2024-08-02

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX7000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). On all ACX 7000 Series platforms running Junos OS Evolved, and configured with IRBs, if a Customer Edge device (CE) device is dual homed to two Provider Edge devices (PE) a traffic loop will occur when the CE sends multicast packets. This issue can be triggered by IPv4 and IPv6 traffic. This issue affects Junos OS Evolved: All versions from 22.2R1-EVO and later versions before 22.4R2-EVO, This issue does not affect Junos OS Evolved versions before 22.1R1-EVO.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00246 15th percentileScored 2026-11-07

Fix Fixed Junos OS Evolved (Juniper Networks): 22.4R2-EVO

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Juniper	Junos OS Evolved	22.1-EVO; 22.2-EVO; 22.3-EVO; 22.4-EVO to before 22.4R2-EVO	22.4R2-EVO	Patch available	CNA

Junos OS Evolved VendorJuniper Affected 22.1-EVO; 22.2-EVO; 22.3-EVO; 22.4-EVO to before 22.4R2-EVO Fixed in 22.4R2-EVO Patch available CNA

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:o:juniper:junos_os_evolved::::::::	22.2 to before 22.4	Vulnerable	Juniper
cpe:2.3:o:juniper:junos_os_evolved:22.4:-::::::	22.4	Vulnerable	Juniper
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1::::::	22.4 r1	Vulnerable	Juniper
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s1::::::	22.4 r1-s1	Vulnerable	Juniper
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s2::::::	22.4 r1-s2	Vulnerable	Juniper
cpe:2.3:h:juniper:acx7024:-:::::::*	not specified by NVD	Running on	Juniper
cpe:2.3:h:juniper:acx7024x:-:::::::*	not specified by NVD	Running on	Juniper
cpe:2.3:h:juniper:acx7100-32c:-:::::::*	not specified by NVD	Running on	Juniper
cpe:2.3:h:juniper:acx7100-48l:-:::::::*	not specified by NVD	Running on	Juniper
cpe:2.3:h:juniper:acx7332:-:::::::*	not specified by NVD	Running on	Juniper

cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:* Versions 22.2 to before 22.4 Vulnerable ·Juniper
cpe:2.3:o:juniper:junos_os_evolved:22.4:-:*:*:*:*:*:* Versions 22.4 Vulnerable ·Juniper
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1:*:*:*:*:*:* Versions 22.4 r1 Vulnerable ·Juniper
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s1:*:*:*:*:*:* Versions 22.4 r1-s1 Vulnerable ·Juniper
cpe:2.3:o:juniper:junos_os_evolved:22.4:r1-s2:*:*:*:*:*:* Versions 22.4 r1-s2 Vulnerable ·Juniper
cpe:2.3:h:juniper:acx7024:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
cpe:2.3:h:juniper:acx7024x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
cpe:2.3:h:juniper:acx7100-32c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
cpe:2.3:h:juniper:acx7100-48l:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
cpe:2.3:h:juniper:acx7332:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:h:juniper:acx7348:-:::::::*	not specified by NVD	Running on	Juniper
cpe:2.3:h:juniper:acx7509:-:::::::*	not specified by NVD	Running on	Juniper

cpe:2.3:h:juniper:acx7348:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper
cpe:2.3:h:juniper:acx7509:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Juniper

Remediation

Fix · CNA Junos OS Evolved (Juniper Networks) Fixed in 22.4R2-EVO

Timeline

2026-10-02 Threatist record created from CVE-2024-39519
2026-10-03 Alias added: GHSA-cr76-625x-q34w

References

Advisory 1

https://supportportal.juniper.net/JSA82983

TI-2026-17602 Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root CVSS 4.0CRITICAL 9.3
TI-2026-17601 Junos OS and Junos OS Evolved: Configuration of a specific SSH option results in mgd crash CVSS 4.0MEDIUM 6.7
TI-2023-04136 Improper input validation in Juniper Junos OS CVSS 3.1HIGH 7.5
TI-2026-74215 Stack-based buffer overflow in Junos OS rpd triggered by BGP peers CVSS 4.0CRITICAL 9.3
TI-2026-74211 Authentication bypass in Juniper J-Web allows pre-auth CGI execution CVSS 4.0CRITICAL 9.3
TI-2021-00146 Junos OS and Junos OS Evolved: Upon receipt of a specific BGP FlowSpec message network traffic may be disrupted. CVSS 3.1CRITICAL 10.0

See all 249 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences