Juniper Junos any version

Junos OS and Junos OS Evolved: With certain BGP options enabled, receipt of specifically malformed BGP update causes RPD crash

Junos OS and Junos OS Evolved: When BGP traceoptions is enabled, receipt of specially crafted BGP packet causes RPD crash

Junos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to RPD crash

Junos OS: MX Series: Decapsulation of specific GRE packets leads to PFE reset

Junos OS and Junos OS Evolved: Receipt of a specific ICMPv6 packet causes a memory overrun leading to an rpd crash

Junos OS: MX Series, SRX Series: Processing of specific SIP INVITE messages by the SIP ALG will lead to an FPC crash

Junos OS: MX240, MX480, MX960 with SPC3: An attacker sending specific packets will cause a CPU utilization DoS.

Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the device

Junos OS: SRX Series, MX Series with MX-SPC3 or MS-MPC: Receipt of multiple specific SIP messages results in flow management process crash

Junos OS: SRX Series: On devices with Anti-Virus enabled, malicious server responses will cause memory to leak ultimately causing forwarding to stop

Junos OS: SRX Series: Transmission of specific control traffic sent out of a DS-Lite tunnel results in flowd crash

Junos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crash

Junos OS: SRX and MX Series: When TCP packets occur in a specific sequence flowd crashes

Junos OS: An invalid certificate causes a Denial of Service in the Internet Key Exchange (IKE) process

Junos OS: SRX Series: A specifically malformed GTP message will cause an FPC crash

Junos OS: After removing ssh public key authentication root can still log in

Junos OS and Junos OS Evolved: When an unsigned Python op script configuration is present, a local low privileged user can compromise the system

Junos OS and Junos OS Evolved: Execution of crafted CLI commands allows for arbitrary shell injection as root

Junos OS and Junos OS Evolved: Privilege escalation to root via CLI command 'request system logout'

Junos OS: An unauthenticated attacker with local access to the device can create a backdoor with root privileges

Junos OS: Privileged local user can gain access to a Linux-based FPC as root

Junos OS: SRX Series: Insufficient certificate verification for device to SD cloud communication

Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP path attribute leads to an RPD crash

Junos OS and Junos OS Evolved: The l2ald crashes on receiving telemetry messages from a specific subscription

Junos OS: Specific unknown traffic pattern causes FPC and system to crash when packet capturing is enabled

Junos OS and Junos OS Evolved: When a static route points to a reject next-hop and a gNMI query for this route is processed, RPD crashes

Junos OS: MX Series with SPC3, SRX Series: Specific packet in response to a TCP connection establishment by the affected device can crash the PFE

Junos OS: MX Series: When specific SIP packets are processed the MS-MPC will crash

Junos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crash

Junos OS: Due to a race condition AgentD process causes a memory corruption and FPC reset

Junos OS: SRX Series and MX Series: Receipt of specific SIP packets in a high utilization situation causes a flowd/mspmand crash

Junos OS: SRX Series: A large amount of traffic being processed by ATP Cloud can lead to a PFE crash

Junos OS: Login credentials are vulnerable to brute force attacks through the REST API

Junos OS: J-Web can be compromised through reflected XSS attacks

The PFE daemon in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service via an unspecified connection request to the "host-OS."

J-Web in Juniper vSRX virtual firewalls with Junos OS before 15.1X49-D20 allows remote attackers to cause a denial of service (system reboot) via unspecified vectors.

Juniper Junos OS before 12.1X44-D60, 12.1X46 before 12.1X46-D40, 12.1X47 before 12.1X47-D30, 12.3 before 12.3R11, 12.3X48 before 12.3X48-D20, 13.2 before 13.2R9, 13.2X51 before 13.2X51-D39, 13.3 before 13.3R8, 14.1 before 14.1R6, 14.1X53 before 14.1X53-D30, 14.2 before 14.2R4-S1, 15.1 before 15.1R2, 15.1X49 before 15.1X49-D30, and 16.1 before 16.1R1 allow remote attackers to cause a denial of service (socket consumption) via crafted TCP timestamps.

Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9-S1, 14.1 before 14.1R7, 14.2 before 14.2R6, 15.1 before 15.1F2-S5, 15.1F4 before 15.1F4-S2, 15.1R before 15.1R2-S3, 15.1 before 15.1R3, and 15.1X49 before 15.1X49-D40 allow remote attackers to cause a denial of service (kernel crash) via a crafted UDP packet destined to the interface IP address of a 64-bit OS device.

Junos OS: EX2300 Series, EX3400 Series, and ACX710 might become unresponsive if the out-of-band management port receives a flood of traffic

Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to "safe mode" authentication and allows root CLI logins without a password after a failed upgrade to 12.1X46, which might allow local users to gain privileges by leveraging use of the "request system software" command with the "partition" option.