CVE-2024-21598highCWE-1286

CVE-2024-21598: high-severity vulnerability in Juniper Networks Junos OS

Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crash

Published · Updated

Follow this CVE+ Monitor Junos OS+ Monitor Junos OS Evolved

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.6%
In short

A flaw in Juniper routers allows an attacker on the network to crash the routing system by sending a specially malformed BGP message. When this happens, the router restarts, interrupting all traffic passing through it.

Technical detail

An improper validation vulnerability in the Routing Protocol Daemon (rpd) of Junos OS and Junos OS Evolved allows a network-based unauthenticated attacker to trigger a DoS via a crafted BGP update containing a malformed tunnel encapsulation attribute TLV. Upon receipt over an established BGP session, the malformed input causes rpd to crash and restart, disrupting routing services.

Summary generated and translated by AI from the official description.
An Improper Validation of Syntactic Correctness of Input vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). If a BGP update is received over an established BGP session which contains a tunnel encapsulation attribute with a specifically malformed TLV, rpd will crash and restart. This issue affects Juniper Networks Junos OS: * 20.4 versions 20.4R1 and later versions earlier than 20.4R3-S9; * 21.2 versions earlier than 21.2R3-S7; * 21.3 versions earlier than 21.3R3-S5; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R3-S4; * 22.2 versions earlier than 22.2R3-S3; * 22.3 versions earlier than 22.3R3-S1; * 22.4 versions earlier than 22.4R3; * 23.2 versions earlier than 23.2R1-S2, 23.2R2; Junos OS Evolved: * 20.4-EVO versions 20.4R1-EVO and later versions earlier than 20.4R3-S9-EVO; * 21.2-EVO versions earlier than 21.2R3-S7-EVO; * 21.3-EVO versions earlier than 21.3R3-S5-EVO; * 21.4-EVO versions earlier than 21.4R3-S5-EVO; * 22.1-EVO versions earlier than 22.1R3-S4-EVO; * 22.2-EVO versions earlier than 22.2R3-S3-EVO; * 22.3-EVO versions earlier than 22.3R3-S1-EVO; * 22.4-EVO versions earlier than 22.4R3-EVO; * 23.2-EVO versions earlier than 23.2R1-S2-EVO, 23.2R2-EVO; This issue does not affect Juniper Networks * Junos OS versions earlier than 20.4R1; * Junos OS Evolved versions earlier than 20.4R1-EVO. This is a related but separate issue than the one described in JSA79095.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Affected products
Juniper Networks · Junos OSJuniper Networks · Junos OS Evolved
Related CVEs — Juniper Networks Junos OS

In the same product, most dangerous first.

CVE-2023-36845CRITICALJunos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variableEPSS 95.1%KEVCVE-2023-36846MEDIUMJunos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesEPSS 93.5%KEVCVE-2023-36844MEDIUMJunos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variablesEPSS 90.0%KEVCVE-2023-36847MEDIUMJunos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesEPSS 83.5%KEVCVE-2020-1631HIGHOut of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) servicesEPSS 4.9%KEVCVE-2025-21590MEDIUMJunos OS: An local attacker with shell access can execute arbitrary codeEPSS 1.7%KEV