Design/Logic Flaw

Receipt of a specifically malformed NDP packet sent from the local area network LAN to a device running Juniper Networks Junos OS Evolved can cause the ndp process to crash, resulting in a Denial of Service DoS. The process automatically restarts without intervention, but a continuous receipt of...

Design/Logic Flaw

On Juniper Networks Junos OS and Junos OS Evolved devices, BGP session flapping can lead to a routing process daemon RPD crash and restart, limiting the attack surface to configured BGP peers. This issue only affects devices with BGP damping in combination with accepted-prefix-limit configuration...

Authentication flaw

When Security Assertion Markup Language SAML authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certificates which could allow a malicious network-based user to access unauthorized data. This issue affects all Juniper Networks Mist Cloud UI...

Input validation

An input validation vulnerability exists in Juniper Networks Junos OS, allowing an attacker to crash the srxpfe process, causing a Denial of Service DoS through the use of specific maintenance commands. The srxpfe process restarts automatically, but continuous execution of the commands could lead...

Cross site scripting

Insufficient Cross-Site Scripting XSS protection in Juniper Networks J-Web and web based HTTP/HTTPS services allows an unauthenticated attacker to hijack the target user's HTTP/HTTPS session and perform administrative actions on the Junos device as the targeted user. This issue only affects Junip...

Design/Logic Flaw

The Juniper Device Manager JDM container, used by the disaggregated Junos OS architecture on Juniper Networks NFX350 Series devices, stores password hashes in the world-readable file /etc/passwd. This is not a security best current practice as it can allow an attacker with access to the local...

Design/Logic Flaw

On Juniper Networks Junos OS devices, receipt of a malformed IPv6 packet may cause the system to crash and restart vmcore. This issue can be trigged by a malformed IPv6 packet destined to the Routing Engine. An attacker can repeatedly send the offending packet resulting in an extended Denial of...

Design/Logic Flaw

On Juniper Networks Junos OS platforms configured as DHCPv6 local server or DHCPv6 Relay Agent, Juniper Networks Dynamic Host Configuration Protocol Daemon JDHCPD process might crash with a core dump if a malformed DHCPv6 packet is received, resulting with the restart of the daemon. This issue on...

CVE-2020-1689

The CVE-2020-1689 entry affects Junos OS on Juniper EX4300-MP, EX4600, and QFX5K Series deployed in Virtual Chassis. It describes a DoS-like high CPU load caused by receipt of a stream of specific Layer 2 frames from within the broadcast domain, potentially leading to traffic interruption. The is...

CVE-2020-1689 Junos OS: EX4300-MP/EX4600/QFX5K Series: High CPU load due to receipt of specific layer 2 frames when deployed in a Virtual Chassis configuration

On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in a Virtual Chassis configuration, receipt of a stream of specific layer 2 frames can cause high CPU load, which could lead to traffic interruption. This issue does not occur when the device is deployed in Stand Alone...

CVE-2020-1688

Technical details (affected products/versions/impact/fix) are not publicly available in the provided connected documents. Monitor for updates.

CVE-2020-1688 Junos OS: SRX and NFX Series: Insufficient Web API private key protection

On Juniper Networks SRX Series and NFX Series, a local authenticated user with access to the shell may obtain the Web API service private key that is used to provide encrypted communication between the Juniper device and the authenticator services. Exploitation of this vulnerability may allow an...

CVE-2020-1687

CVE-2020-1687 affects Junos OS on Juniper EX4300-MP, EX4600 and QFX5K series used as EVPN-VXLAN L2/L3 gateways. The issue occurs when receiving a stream of specific VXLAN-encapsulated L2 frames within the same EVPN-VXLAN domain, causing high CPU load and potentially impacting network protocol ope...

CVE-2020-1686

CVE-2020-1686 affects Junos OS where receipt of a malformed IPv6 packet can crash the system (vmcore) and restart, enabling an extended DoS when attacked via IPv6 to the Routing Engine. The issue is IPv6-specific; IPv4 packets are not affected. Affected Junos OS versions include 18.4R2-S4 and ear...

CVE-2020-1686 Junos OS: Kernel crash (vmcore) upon receipt of a malformed IPv6 packet.

On Juniper Networks Junos OS devices, receipt of a malformed IPv6 packet may cause the system to crash and restart vmcore. This issue can be trigged by a malformed IPv6 packet destined to the Routing Engine. An attacker can repeatedly send the offending packet resulting in an extended Denial of...

CVE-2020-1687 Junos OS: EX4300-MP/EX4600/QFX5K Series: High CPU load due to receipt of specific layer 2 frames in EVPN-VXLAN deployment.

On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in Ethernet VPN EVPN-Virtual Extensible LAN VXLAN configuration, receipt of a stream of specific VXLAN encapsulated layer 2 frames can cause high CPU load, which could lead to network protocol operation issue and traffi...

CVE-2020-1685

CVE-2020-1685 affects Juniper Networks Junos OS on EX4600 and QFX5K (VXLAN) where stateless firewall filters with a single user-vlan-id match can cause the discard action to only drop traffic with that VLAN ID, allowing other VLANs through. Affected QFX5K/Junos versions are listed in the CVE entr...

CVE-2020-1685 Junos OS: EX4600, QFX5K Series: Stateless firewall filter matching 'user-vlan-id' will cause incomplete discard action

When configuring stateless firewall filters in Juniper Networks EX4600 and QFX 5000 Series devices using Virtual Extensible LAN protocol VXLAN, the discard action will fail to discard traffic under certain conditions. Given a firewall filter configuration similar to: family ethernet-switching...

CVE-2020-1684

CVE-2020-1684 affects Juniper Networks Junos OS on SRX Series. The issue is triggered when application identification inspection is enabled and specific HTTP traffic is processed, causing high CPU load and potential traffic interruption. Affected versions include SRX Series: 12.3X48 prior to 12.3...

CVE-2020-1684 Junos OS: SRX Series: High CPU load due to processing for HTTP traffic when Application Identification is enabled.

On Juniper Networks SRX Series configured with application identification inspection enabled, receipt of specific HTTP traffic can cause high CPU load utilization, which could lead to traffic interruption. Application identification is enabled by default and is automatically turned on when...