Juniper Junos OS USB Device status code

Summaryinfo

A vulnerability has been found in Juniper Junos OS and classified as problematic. This vulnerability affects unknown code of the component USB Device Handler. The manipulation leads to status code. This vulnerability is traded as CVE-2023-28975. It is possible to launch the attack on the physical device. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Juniper Junos OS (Router Operating System) (the affected version unknown) and classified as problematic. This issue affects an unknown part of the component USB Device Handler. The manipulation with an unknown input leads to a status code vulnerability. Using CWE to declare the problem leads to CWE-394. The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product. Impacted is availability. The summary by CVE is:

An Unexpected Status Code or Return Value vulnerability in the kernel of Juniper Networks Junos OS allows an unauthenticated attacker with physical access to the device to cause a Denial of Service (DoS). When certain USB devices are connected to a USB port of the routing-engine (RE), the kernel will crash leading to a reboot of the device. The device will continue to crash as long as the USB device is connected. This issue affects Juniper Networks Junos OS: All versions prior to 19.4R3-S10; 20.2 versions prior to 20.2R3-S7; 20.3 versions prior to 20.3R3-S6; 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S4; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S2; 22.1 versions prior to 22.1R2-S2, 22.1R3; 22.2 versions prior to 22.2R2, 22.2R3; 22.3 versions prior to 22.3R1-S1, 22.3R2; 22.4 versions prior to 22.4R2.

The weakness was shared 04/18/2023 as JSA70600. The advisory is shared at supportportal.juniper.net. The identification of this vulnerability is CVE-2023-28975 since 03/29/2023. Neither technical details nor an exploit are publicly available.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-32593). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion