VulnerabilityAnalyzed

CVE-2024-21591

CRITICAL 9.8EPSS 17.7%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 17.7%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.

Description

An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device. This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory. This issue affects Juniper Networks Junos OS SRX Series and EX Series: * Junos OS versions earlier than 20.4R3-S9; * Junos OS 21.2 versions earlier than 21.2R3-S7; * Junos OS 21.3 versions earlier than 21.3R3-S5; * Junos OS 21.4 versions earlier than 21.4R3-S5; * Junos OS 22.1 versions earlier than 22.1R3-S4; * Junos OS 22.2 versions earlier than 22.2R3-S3; * Junos OS 22.3 versions earlier than 22.3R3-S2; * Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 17.67% probability · 97th percentile
CISA KEV: Not listed
Weakness: CWE-787
Affected: juniper/junos
Source: sirt@juniper.net

References

https://curesec.com/blog/article/CVE-2024-21591_Juniper_Remote_Code_Exec.htmlExploit, Third Party Advisory
https://supportportal.juniper.net/JSA75729Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NThird Party Advisory
https://curesec.com/blog/article/CVE-2024-21591_Juniper_Remote_Code_Exec.htmlExploit, Third Party Advisory
https://supportportal.juniper.net/JSA75729Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.