CVE-2016-1277

Name: CVE-2016-1277
Creator: NVD / NIST
Published: 2016-09-09T14:05:04.063+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.66%

Last modified Jun 17, 2026

CVE-2016-1277 is a vulnerability of currently unknown severity. Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D40, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40, 14.2 before 14.2R6, 15.1 before 15.1F6 or 15.1R3, and 15.1X49 before 15.1X49-D40, when configured with a GRE or IPIP tunnel, allow remote attackers to cause a denial of service (kernel panic) via a crafted ICMP packet.. EPSS estimates a 1.66% chance of exploitation in the next 30 days.

Description

Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D40, 12.3X48 before 12.3X48-D30, 13.3 before 13.3R9, 14.1 before 14.1R8, 14.1X53 before 14.1X53-D40, 14.2 before 14.2R6, 15.1 before 15.1F6 or 15.1R3, and 15.1X49 before 15.1X49-D40, when configured with a GRE or IPIP tunnel, allow remote attackers to cause a denial of service (kernel panic) via a crafted ICMP packet.

Metrics

EPSS Probability

1.66%

73.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-20

Affected Software

Vendor	Product	Versions	Update
Juniper	Junos	<= 12.1x46	D45
Juniper	Junos	12.1x47	—
Juniper	Junos	12.3x48	D10
Juniper	Junos	13.3	—
Juniper	Junos	14.1	—
Juniper	Junos	14.1x53	—
Juniper	Junos	14.2	R1
Juniper	Junos	15.1	F2
Juniper	Junos	15.1x49	D10

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10752Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/91755
http://www.securitytracker.com/id/1036306
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10752Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/91755
http://www.securitytracker.com/id/1036306

Timeline

Published: Sep 9, 2016
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-1277?

How severe is CVE-2016-1277?

Severity scoring for CVE-2016-1277 is pending analysis. The EPSS model estimates a 1.66% probability of exploitation in the next 30 days.

How do I fix CVE-2016-1277?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-1277?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST