CVE-2021-0285

An uncontrolled resource consumption vulnerability in Juniper Networks Junos OS on QFX5000 Series and EX4600 Series switches allows an attacker sending large amounts of legitimate traffic destined to the device to cause Interchassis Control Protocol (ICCP) interruptions, leading to an unstable control connection between the Multi-Chassis Link Aggregation Group (MC-LAG) nodes which can in turn lead to traffic loss. Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. An indication that the system could be impacted by this issue is the following log message: "DDOS_PROTOCOL_VIOLATION_SET: Warning: Host-bound traffic for protocol/exception LOCALNH:aggregate exceeded its allowed bandwidth at fpc <fpc number> for <n> times, started at <timestamp>" This issue affects Juniper Networks Junos OS on QFX5000 Series and EX4600 Series: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13, 17.4R3-S5; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8, 18.4R3-S7; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S6, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S2; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2; 20.4 versions prior to 20.4R1-S1, 20.4R2.

• CWE-770
• CWE-400

• https://kb.juniper.net/JSA11187Vendor Advisory
• https://kb.juniper.net/JSA11187Vendor Advisory

Published

Jul 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-0279Juniper Networks Contrail Cloud (CC) releases prior to 13.6.…5.5
• CVE-2021-0280Due to an Improper Initialization vulnerability in Juniper N…7.5
• CVE-2021-0281On Juniper Networks Junos OS devices configured with BGP ori…7.5
• CVE-2021-0282On Juniper Networks Junos OS devices with Multipath or add-p…7.5
• CVE-2021-0283A buffer overflow vulnerability in the TCP/IP stack of Junip…7.5
• CVE-2021-0284A buffer overflow vulnerability in the TCP/IP stack of Junip…7.5
• CVE-2021-0286A vulnerability in the handling of exceptional conditions in…7.5
• CVE-2021-0287In a Segment Routing ISIS (SR-ISIS)/MPLS environment, on Jun…6.5
• CVE-2021-0288A vulnerability in the processing of specific MPLS packets i…6.5
• CVE-2021-0289When user-defined ARP Policer is configured and applied on o…5.3
• CVE-2021-0290Improper Handling of Exceptional Conditions in Ethernet inte…6.5
• CVE-2021-0291An Exposure of System Data vulnerability in Juniper Networks…6.5