Junos Os CVE-2026-33773

This vulnerability presents a real but constrained security risk. The CVSS v4.0 score of 6.9 reflects an unauthenticated, network-based attack vector with low complexity and no privilege requirement, but the impact is limited to integrity (SI:L-scope integrity low), with no confidentiality or availability loss (VC:N, VA:N, SA:N). The EPSS probability metric (6.9) suggests moderate likelihood of exploitation, but the practical impact depends on network topology: an attacker must be able to send traffic destined for an interface where the filter should block; only then can they exploit the partial filter bypass. The vulnerability is not confirmed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept has been identified at the time of analysis. Under SSVC decision logic, this is a 'Manage' case-real security impact (traffic bypass violates defense-in-depth), but exploitation requires network proximity and specific device/version combination, and automatable exploitation is not trivially achievable without detailed knowledge of the filter configuration. Organizations running unaffected versions or without dual IRB/physical interface filter policies are not at risk.

An attacker on the same network as a vulnerable EX4400 switch (or other affected SKU) observes that a filter is configured to block outbound traffic of a certain class on both an IRB interface and an attached physical interface. Due to the initialization flaw, only one of the two filters is enforced in the packet forwarding engine. The attacker sends carefully crafted traffic toward the physical interface that should be dropped by the egress filter but is instead forwarded because the filter was not properly initialized, allowing unauthorized traffic to exit the network and potentially reaching downstream systems. No public proof-of-concept has been identified, but exploitation requires network-layer access and knowledge of the filter configuration.