CVE-2023-22408

An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). When an attacker sends an SIP packets with a malformed SDP field then the SIP ALG can not process it which will lead to an FPC crash and restart. Continued receipt of these specific packets will lead to a sustained Denial of Service. This issue can only occur when both below mentioned conditions are fulfilled: 1. Call distribution needs to be enabled: [security alg sip enable-call-distribution] 2. The SIP ALG needs to be enabled, either implicitly / by default or by way of configuration. To confirm whether SIP ALG is enabled on SRX, and MX with SPC3 use the following command: user@host> show security alg status | match sip SIP : Enabled This issue affects Juniper Networks Junos OS on SRX 5000 Series: 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S3; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S2; 22.1 versions prior to 22.1R2-S2, 22.1R3; 22.2 versions prior to 22.2R3; 22.3 versions prior to 22.3R1-S1, 22.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.

• CWE-129
• CWE-129

• https://kb.juniper.net/JSA70204Vendor Advisory
• https://kb.juniper.net/JSA70204Vendor Advisory

Published

Jan 13, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-22402A Use After Free vulnerability in the kernel of Juniper Netw…5.9
• CVE-2023-22403 An Allocation of Resources Without Limits or Throttling vul…7.5
• CVE-2023-22404An Out-of-bounds Write vulnerability in the Internet Key Exc…6.5
• CVE-2023-22405An Improper Preservation of Consistency Between Independent …6.5
• CVE-2023-22406A Missing Release of Memory after Effective Lifetime vulnera…6.5
• CVE-2023-22407An Incomplete Cleanup vulnerability in the Routing Protocol …6.5
• CVE-2023-22409An Unchecked Input for Loop Condition vulnerability in a NAT…5.5
• CVE-2023-2241A vulnerability, which was classified as critical, was found…5.3
• CVE-2023-22410A Missing Release of Memory after Effective Lifetime vulnera…6.5
• CVE-2023-22411An Out-of-Bounds Write vulnerability in Flow Processing Daem…7.5
• CVE-2023-22412An Improper Locking vulnerability in the SIP ALG of Juniper …7.5
• CVE-2023-22413An Improper Check or Handling of Exceptional Conditions vuln…7.5