CVE-2024-47489 — Junos OS Evolved: ACX Series: Receipt of specific transit protocol packets is incorrectly processed by the RE

An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices. Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices. This issue affects both IPv4 and IPv6. This issue does not require any specific routing protocol to be configured or enabled. The following commands can be used to monitor the DDoS protection queue: labuser@re0> show evo-pfemand host pkt-stats…

Published Oct 11, 2024Updated Oct 11, 2024Sources: cvelistV5, juniper

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

chance of exploitation in 30 days

Affects

juniper networks

2 products listed

CVSS base

5.8

MEDIUM

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

None

none · proof-of-concept · active

Automatable

Yes

can an attacker script all four kill-chain steps

Technical impact

Partial

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (2)

juniper networks juniper

Products (2)

junos os evolvedjunos evolved

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

Score	Version	Severity	Expl.	Impact	Source
5.8	CVSS 3.1	MEDIUM	—	—	cvelistV5

Weakness & attack patterns

CWE-755

References

1 on the record

supportportal.juniper.net/
vendor-advisory

Elsewhere on this site

juniper networksevery CVE for this vendor
juniperevery CVE for this vendor
CWE-755other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.