Junos OS MX Series CVE-2026-57031

All of the following conditions must simultaneously be true for exploitation: (1) the device must be a Juniper MX Series router running a vulnerable Junos OS version (23.2R2-S1 to 23.2R2-S6, 23.4R2 to 23.4R2-S6, 24.2 before 24.2R2-S3, 24.4 before 24.4R2-S2, or 25.2 before 25.2R2); (2) the device must be equipped with MPC10/11, LC4800, LC9600, LC4802, or MX304 hardware - other line cards are not stated to be affected; (3) subscriber sessions must be provisioned specifically on static interfaces, not dynamic interfaces; (4) at least one ingress firewall filter must be configured on those subscriber interfaces. Exploitation is limited to adjacent subscribers - internet-accessible remote exploitation is not possible (AV:A). The attack cannot compromise router confidentiality, gain control-plane access, or cause denial of service to the router itself; impact is restricted to bypassing per-subscriber traffic policy and bandwidth controls.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects a constrained attack surface: the adjacent vector (AV:A) restricts exploitation to legitimate subscribers sharing the same network segment, and the impact is limited to subsequent system integrity at Low severity (SI:L) with no direct CIA impact on the vulnerable router itself. No EPSS data was provided, so exploitation probability cannot be quantified independently. The vulnerability is not in CISA KEV and no public POC has been identified, indicating no confirmed active exploitation at time of analysis. However, the AU:Y (Automatable: Yes) flag in the CVSS 4.0 supplemental metrics is operationally significant for ISP environments: an attacker with subscriber access could automate firewall policy bypass across the session without human interaction. The real-world business risk for carrier deployments extends beyond what the technical CVSS score reflects - unauthorized protocol access and unmetered bandwidth consumption have direct commercial and SLA implications. Overall, this is a genuine operational risk for ISPs running the affected hardware, but not an emergency priority for non-carrier enterprise environments.

A broadband subscriber connected through a Juniper MX Series BNG equipped with an MPC10/11 or MX304 line card deliberately sends traffic using protocols that should be blocked by their ingress firewall policy - for example, crafting packets to routing protocol ports (BGP/OSPF) or management-plane addresses, or streaming traffic at rates exceeding their contracted bandwidth tier. Because the PFE silently skips ingress filter evaluation for static-interface subscriber sessions on the affected hardware, the subscriber's restricted traffic reaches downstream network segments unimpeded and bandwidth policing is not applied. No public exploit code exists, but the attack requires only that the subscriber send standard network traffic on an otherwise normal session.