CVE-2023-36849

An Improper Check or Handling of Exceptional Conditions vulnerability in the Layer-2 control protocols daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated adjacent attacker to cause a Denial of Service (DoS). When a malformed LLDP packet is received, l2cpd will crash and restart. The impact of the l2cpd crash is reinitialization of STP protocols (RSTP, MSTP or VSTP), and MVRP and ERP. Also, if any services depend on LLDP state (like PoE or VoIP device recognition), then these will also be affected. Continued receipt of such packets will lead to a sustained Denial of Service. This issue affects: Juniper Networks Junos OS 21.4 versions prior to 21.4R3-S3; 22.1 versions prior to 22.1R3-S3; 22.2 versions prior to 22.2R2-S1, 22.2R3; 22.3 versions prior to 22.3R2. Juniper Networks Junos OS Evolved 21.4-EVO versions prior to 21.4R3-S2-EVO; 22.1-EVO versions prior to 22.1R3-S3-EVO; 22.2-EVO versions prior to 22.2R2-S1-EVO, 22.2R3-EVO; 22.3-EVO versions prior to 22.3R2-EVO.

• CWE-703

• https://supportportal.juniper.net/JSA71660Mitigation, Vendor Advisory
• https://supportportal.juniper.net/JSA71660Mitigation, Vendor Advisory

Published

Jul 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-36843 An Improper Handling of Inconsistent Special Elements vulne…7.5
• CVE-2023-36844A PHP External Variable Modification vulnerability in J-Web …5.3
• CVE-2023-36845A PHP External Variable Modification vulnerability in J-Web …9.8
• CVE-2023-36846A Missing Authentication for Critical Function vulnerability…5.3
• CVE-2023-36847A Missing Authentication for Critical Function vulnerability…5.3
• CVE-2023-36848An Improper Handling of Undefined Values vulnerability in th…6.5
• CVE-2023-3685A vulnerability was found in Nesote Inout Search Engine AI E…5.4
• CVE-2023-36850An Improper Validation of Specified Index, Position, or Offs…6.5
• CVE-2023-36851A Missing Authentication for Critical Function vulnerability…5.3
• CVE-2023-36853 ​In Keysight Geolocation Server v2.4.2 and prior, a low…7.8
• CVE-2023-36854The issue was addressed with improved checks. This issue is …7.8
• CVE-2023-36857 Baker Hughes – Bently Nevada 3500 System TDI Firmware ver…6.5