CVE-2021-0243

Improper Handling of Unexpected Data in the firewall policer of Juniper Networks Junos OS on EX4300 switches allows matching traffic to exceed set policer limits, possibly leading to a limited Denial of Service (DoS) condition. When the firewall policer discard action fails on a Layer 2 port, it will allow traffic to pass even though it exceeds set policer limits. Traffic will not get discarded, and will be forwarded even though a policer discard action is configured. When the issue occurs, traffic is not discarded as desired, which can be observed by comparing the Input bytes with the Output bytes using the following command: user@junos> monitor interface traffic Interface Link Input bytes (bps) Output bytes (bps) ge-0/0/0 Up 37425422 (82616) 37425354 (82616) <<<< egress ge-0/0/1 Up 37425898 (82616) 37425354 (82616) <<<< ingress The expected output, with input and output counters differing, is shown below: Interface Link Input bytes (bps) Output bytes (bps) ge-0/0/0 Up 342420570 (54600) 342422760 (54600) <<<< egress ge-0/0/1 Up 517672120 (84000) 342420570 (54600) <<<< ingress This issue only affects IPv4 policing. IPv6 traffic and firewall policing actions are not affected by this issue. This issue affects Juniper Networks Junos OS on the EX4300: All versions prior to 17.3R3-S10; 17.4 versions prior to 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R3-S6; 19.1 versions prior to 19.1R3-S3; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R3-S1; 19.4 versions prior to 19.4R3; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R2.

• CWE-241

• https://kb.juniper.net/JSA11136Vendor Advisory
• https://kb.juniper.net/JSA11136Vendor Advisory

Published

Apr 22, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-0237On Juniper Networks EX4300-MP Series, EX4600 Series, EX4650 …6.5
• CVE-2021-0238When a MX Series is configured as a Broadband Network Gatewa…5.5
• CVE-2021-0239In Juniper Networks Junos OS Evolved, receipt of a stream of…6.5
• CVE-2021-0240On Juniper Networks Junos OS platforms configured as DHCPv6 …6.5
• CVE-2021-0241On Juniper Networks Junos OS platforms configured as DHCPv6 …6.5
• CVE-2021-0242A vulnerability due to the improper handling of direct memor…6.5
• CVE-2021-0244A signal handler race condition exists in the Layer 2 Addres…7.4
• CVE-2021-0245A Use of Hard-coded Credentials vulnerability in Juniper Net…7.8
• CVE-2021-0246On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with S…7.3
• CVE-2021-0247A Race Condition (Concurrent Execution using Shared Resource…5.5
• CVE-2021-0248This issue is not applicable to NFX NextGen Software. On NFX…10
• CVE-2021-0249On SRX Series devices configured with UTM services a buffer …9.8