Juniper Networks Junos OS up to 22.4R2 on SRX/MX mismatching unusual condition

Summaryinfo

A vulnerability, which was classified as critical, has been found in Juniper Networks Junos OS up to 22.4R2 on SRX/MX. This impacts an unknown function. The manipulation of the argument mismatching leads to unusual condition. This vulnerability is documented as CVE-2024-39545. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Juniper Networks Junos OS up to 22.4R2 on SRX/MX. This issue affects an unknown functionality. The manipulation of the argument mismatching with an unknown input leads to a unusual condition vulnerability. Using CWE to declare the problem leads to CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. Impacted is availability. The summary by CVE is:

An Improper Check for Unusual or Exceptional Conditions vulnerability in the the IKE daemon (iked) of Juniper Networks Junos OS on SRX Series, MX Series with SPC3 and NFX350 allows allows an unauthenticated, network-based attacker sending specific mismatching parameters as part of the IPsec negotiation to trigger an iked crash leading to Denial of Service (DoS). This issue is applicable to all platforms that run iked. This issue affects Junos OS on SRX Series, MX Series with SPC3 and NFX350:  * All versions before 21.2R3-S8,  * from 21.4 before 21.4R3-S7,  * from 22.1 before 22.1R3-S2,  * from 22.2 before 22.2R3-S1,  * from 22.3 before 22.3R2-S1, 22.3R3,  * from 22.4 before 22.4R1-S2, 22.4R2, 22.4R3.

The advisory is shared at supportportal.juniper.net. The identification of this vulnerability is CVE-2024-39545 since 06/25/2024. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 01/23/2026).

Upgrading to version 21.2R3-S8, 21.4R3-S7, 22.1R3-S2, 22.2R3-S1, 22.3R2-S1, 22.3R3, 22.4R1-S2, 22.4R2 or 22.4R3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Juniper Networks

Name

• Junos OS

Version

• 21.2R3-S7
• 21.4R3-S6
• 22.1R3-S1
• 22.2R3-S0
• 22.3R2
• 22.3R2-S1
• 22.4R1-S2
• 22.4R2

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion