EUVD-2026-42721
GHSA-7v7x-35fg-5xc8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:M/U:X
Adjacent subscriber required (AV:A); bypass affects downstream policy integrity only (S:C/I:L); no confidentiality, direct integrity, or availability impact on the router itself.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters.
On MX Series devices with MPC10/11, LC4800/9600, and MX304 with subscribers configured on static interfaces, ingress firewall filters are not enforced, so that neither protocol level nor upstream bandwidth limitation are in effect.
This issue affects Junos OS on MX with MPC10/11, LC4800/9600/4802, and MX304:
- 23.2 versions from 23.2R2-S1 before 23.2R2-S7,
- 23.4 versions from 23.4R2 before 23.4R2-S7,
- 24.2 versions before 24.2R2-S3,
- 24.4 versions before 24.4R2-S2,
- 25.2 versions before 25.2R2.
AnalysisAI
Ingress firewall filter bypass in Juniper Networks Junos OS on MX Series hardware (MPC10/11, LC4800/9600/4802, MX304) allows adjacent subscribers on static interfaces to evade configured protocol-level access controls and upstream bandwidth limitations. The Packet Forwarding Engine (PFE) fails to enforce ingress filters for these subscriber configurations, meaning neither protocol restrictions nor rate-limiting policies take effect. No public exploit code has been identified and the vulnerability is absent from CISA KEV, though the CVSS 4.0 AU:Y (Automatable) supplemental metric indicates exploitation could be scripted at scale against affected broadband aggregation deployments.
Technical ContextAI
The affected component is the Packet Forwarding Engine (PFE), the hardware-accelerated data-plane subsystem in Juniper MX Series routers responsible for forwarding packets at line rate. MX Series devices are carrier-grade routers commonly deployed as Broadband Network Gateways (BNG) or Broadband Remote Access Servers (BRAS) by ISPs to manage subscriber sessions. CWE-754 (Improper Check for Unusual or Exceptional Conditions) identifies the root cause: the PFE fails to evaluate an exceptional condition - specifically, the combination of a particular set of line cards (MPC10/11, LC4800/9600/4802, MX304) with subscribers provisioned on static (as opposed to dynamic) interfaces - and therefore skips ingress firewall filter enforcement entirely. This means per-subscriber access control lists (ACLs) meant to block traffic by protocol, address, or port, along with bandwidth policing policies, are silently bypassed. The affected CPE is cpe:2.3:a:juniper_networks:junos_os across Junos 23.2 through 25.2 on the named hardware.
RemediationAI
Upgrade Junos OS to the following vendor-confirmed fixed versions per advisory JSA110091 at https://supportportal.juniper.net/JSA110091: 23.2R2-S7 or later for the 23.2 branch; 23.4R2-S7 or later for the 23.4 branch; 24.2R2-S3 or later for the 24.2 branch; 24.4R2-S2 or later for the 24.4 branch; 25.2R2 or later for the 25.2 branch. No vendor-documented workarounds are described in the available advisory data. As a compensating control pending patching, operators may consider migrating affected subscriber configurations from static interfaces to dynamic interface models, though this may require substantial reconfiguration of RADIUS/AAA infrastructure and should be tested in a staging environment before production rollout. Additionally, deploying upstream rate-limiting or access controls at the aggregation layer above the affected MX device can partially compensate for the loss of per-subscriber filter enforcement, at the cost of coarser-grained policy application.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today