Juniper Networks Junos OS up to 22.4R1 unusual condition

Summaryinfo

A vulnerability was found in Juniper Networks Junos OS up to 22.4R1. It has been declared as critical. This vulnerability affects unknown code. Executing a manipulation can lead to unusual condition. This vulnerability is handled as CVE-2024-39530. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Juniper Networks Junos OS up to 22.4R1. It has been declared as critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a unusual condition vulnerability. The CWE definition for the vulnerability is CWE-754. The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product. As an impact it is known to affect availability. CVE summarizes:

An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis management daemon (chassisd) of Juniper Networks Junos OS allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an attempt is made to access specific sensors on platforms not supporting these sensors, either via GRPC or netconf, chassisd will crash and restart leading to a restart of all FPCs and thereby a complete outage. This issue affects Junos OS: * 21.4 versions from 21.4R3 before 21.4R3-S5, * 22.1 versions from 22.1R3 before 22.1R3-S4, * 22.2 versions from 22.2R2 before 22.2R3, * 22.3 versions from 22.3R1 before 22.3R2-S2, 22.3R3, * 22.4 versions from 22.4R1 before 22.4R2. This issue does not affect Junos OS versions earlier than 21.4.

The advisory is available at supportportal.juniper.net. This vulnerability was named CVE-2024-39530 since 06/25/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/23/2024).

Upgrading to version 21.4, 21.4R3-S5, 22.1R3-S4, 22.2R3, 22.3R2-S2, 22.3R3 or 22.4R2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Juniper Networks

Name

• Junos OS

Version

• 21.0
• 21.1
• 21.2
• 21.3
• 21.4R3-S4
• 22.1R3-S3
• 22.2R2
• 22.3R2
• 22.3R2-S2
• 22.4R1

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion