{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-21600","assignerOrgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","state":"PUBLISHED","assignerShortName":"juniper","dateReserved":"2023-12-27T19:38:25.706Z","datePublished":"2024-01-12T00:53:38.834Z","dateUpdated":"2025-06-17T21:09:19.373Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["PTX1000","PTX3000","PTX5000 with FPC3","PTX10002-60C","PTX10008/16 with LC110x"],"product":"Junos OS","vendor":"Juniper Networks","versions":[{"lessThan":"20.4R3-S8","status":"affected","version":"0","versionType":"semver"},{"lessThan":"21.1R3-S4","status":"affected","version":"21.1","versionType":"semver"},{"lessThan":"21.2R3-S6","status":"affected","version":"21.2","versionType":"semver"},{"lessThan":"21.3R3-S3","status":"affected","version":"21.3","versionType":"semver"},{"lessThan":"21.4R3-S5","status":"affected","version":"21.4","versionType":"semver"},{"lessThan":"22.1R2-S2, 22.1R3","status":"affected","version":"22.1","versionType":"semver"},{"lessThan":"22.2R2-S1, 22.2R3","status":"affected","version":"22.2","versionType":"semver"}]}],"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

To be exposed to this issue FTI need to be configured:

[ interfaces fti0 unit <unit> tunnel ... ]
"}],"value":"To be exposed to this issue FTI need to be configured:\n\n [ interfaces fti0 unit tunnel ... ]\n"}],"datePublic":"2024-01-10T17:00:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"\n\n

An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS).

When MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover.

Please note that this issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x. Other PTX Series devices and Line Cards (LC) are not affected.

The following log message can be seen when the issue occurs:

Cmerror Op Set: Host Loopback: HOST LOOPBACK WEDGE DETECTED IN PATH ID <id> (URI: /fpc/<fpc>/pfe/<pfe>/cm/<cm>/Host_Loopback/<cm>/HOST_LOOPBACK_MAKE_CMERROR_ID[<id>])

This issue affects Juniper Networks Junos OS:

\n\n"}],"value":"\nAn Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS).\n\nWhen MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover.\n\nPlease note that this issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x. Other PTX Series devices and Line Cards (LC) are not affected.\n\nThe following log message can be seen when the issue occurs:\n\nCmerror Op Set: Host Loopback: HOST LOOPBACK WEDGE DETECTED IN PATH ID (URI: /fpc//pfe//cm//Host_Loopback//HOST_LOOPBACK_MAKE_CMERROR_ID[])\nThis issue affects Juniper Networks Junos OS:\n\n\n\n * All versions earlier than 20.4R3-S8;\n * 21.1 versions earlier than 21.1R3-S4;\n * 21.2 versions earlier than 21.2R3-S6;\n * 21.3 versions earlier than 21.3R3-S3;\n * 21.4 versions earlier than 21.4R3-S5;\n * 22.1 versions earlier than 22.1R2-S2, 22.1R3;\n * 22.2 versions earlier than 22.2R2-S1, 22.2R3.\n\n\n\n\n\n\n"}],"exploits":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

"}],"value":"Juniper SIRT is not aware of any malicious exploitation of this vulnerability.\n\n"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-76","description":"CWE-76 Improper Neutralization of Equivalent Special Elements","lang":"en","type":"CWE"}]},{"descriptions":[{"description":"Denial of Service (DoS)","lang":"en"}]}],"providerMetadata":{"orgId":"8cbe9d5a-a066-4c94-8978-4b15efeae968","shortName":"juniper","dateUpdated":"2024-01-12T00:53:38.834Z"},"references":[{"tags":["vendor-advisory"],"url":"https://supportportal.juniper.net/JSA75741"},{"tags":["technical-description"],"url":"https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S8, 21.1R3-S4, 21.2R3-S6, 21.3R3-S3, 21.4R3-S5, 22.1R2-S2, 22.1R3, 22.2R2-S1, 22.2R3, 22.3R1, and all subsequent releases.

"}],"value":"The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S8, 21.1R3-S4, 21.2R3-S6, 21.3R3-S3, 21.4R3-S5, 22.1R2-S2, 22.1R3, 22.2R2-S1, 22.2R3, 22.3R1, and all subsequent releases.\n\n"}],"source":{"advisory":"JSA75741","defect":["1653316"],"discovery":"USER"},"timeline":[{"lang":"en","time":"2024-01-10T17:00:00.000Z","value":"Initial Publication"}],"title":"Junos OS: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge condition","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

The issue can be prevented by configuring a limit for reject packets via:

[ system ddos-protection protocols reject aggregate bandwidth 20 ]
"}],"value":"The issue can be prevented by configuring a limit for reject packets via:\n\n [ system ddos-protection protocols reject aggregate bandwidth 20 ] \n"}],"x_generator":{"engine":"Vulnogram 0.1.0-av217"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-01T22:27:35.359Z"},"title":"CVE Program Container","references":[{"tags":["vendor-advisory","x_transferred"],"url":"https://supportportal.juniper.net/JSA75741"},{"tags":["technical-description","x_transferred"],"url":"https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}]},{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-21600","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-01-12T18:09:08.163929Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-06-17T21:09:19.373Z"}}]}}