CVE-2022-22157

A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juniper Deep Packet Inspection (JDPI) rules and access unauthorized networks or resources, when 'no-syn-check' is enabled on the device. JDPI incorrectly classifies out-of-state asymmetric TCP flows as the dynamic-application INCONCLUSIVE instead of UNKNOWN, which is more permissive, causing the firewall to allow traffic to be forwarded that should have been denied. This issue only occurs when 'set security flow tcp-session no-syn-check' is configured on the device. This issue affects Juniper Networks Junos OS on SRX Series: 18.4 versions prior to 18.4R2-S9, 18.4R3-S9; 19.1 versions prior to 19.1R2-S3, 19.1R3-S6; 19.2 versions prior to 19.2R1-S7, 19.2R3-S3; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R2-S5, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R3-S1; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2-S1, 20.4R3; 21.1 versions prior to 21.1R1-S1, 21.1R2. This issue does not affect Juniper Networks Junos OS versions prior to 18.4R1.

• CWE-863
• CWE-863

• https://kb.juniper.net/JSA11265Vendor Advisory
• https://kb.juniper.net/JSA11265Vendor Advisory

Published

Jan 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-22151CAMS for HIS Log Server contained in the following Yokogawa …8.1
• CVE-2022-22152A Protection Mechanism Failure vulnerability in the REST API…6.5
• CVE-2022-22153An Insufficient Algorithmic Complexity combined with an Allo…7.5
• CVE-2022-22154In a Junos Fusion scenario an External Control of Critical S…6.8
• CVE-2022-22155An Uncontrolled Resource Consumption vulnerability in the ha…6.5
• CVE-2022-22156An Improper Certificate Validation weakness in the Juniper N…7.4
• CVE-2022-22158Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-22159A vulnerability in the NETISR network queue functionality of…7.5
• CVE-2022-2216Server-Side Request Forgery (SSRF) in GitHub repository ioni…9.8
• CVE-2022-22160An Unchecked Error Condition vulnerability in the subscriber…6.5
• CVE-2022-22161An Uncontrolled Resource Consumption vulnerability in the ke…7.5
• CVE-2022-22162A Generation of Error Message Containing Sensitive Informati…7.8