CVE-2024-21600

An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service (DoS). When MPLS packets are meant to be sent to a flexible tunnel interface (FTI) and if the FTI tunnel is down, these will hit the reject NH, due to which the packets get sent to the CPU and cause a host path wedge condition. This will cause the FPC to hang and requires a manual restart to recover. Please note that this issue specifically affects PTX1000, PTX3000, PTX5000 with FPC3, PTX10002-60C, and PTX10008/16 with LC110x. Other PTX Series devices and Line Cards (LC) are not affected. The following log message can be seen when the issue occurs: Cmerror Op Set: Host Loopback: HOST LOOPBACK WEDGE DETECTED IN PATH ID <id> (URI: /fpc/<fpc>/pfe/<pfe>/cm/<cm>/Host_Loopback/<cm>/HOST_LOOPBACK_MAKE_CMERROR_ID[<id>]) This issue affects Juniper Networks Junos OS: * All versions earlier than 20.4R3-S8; * 21.1 versions earlier than 21.1R3-S4; * 21.2 versions earlier than 21.2R3-S6; * 21.3 versions earlier than 21.3R3-S3; * 21.4 versions earlier than 21.4R3-S5; * 22.1 versions earlier than 22.1R2-S2, 22.1R3; * 22.2 versions earlier than 22.2R2-S1, 22.2R3.

• CWE-76

• https://supportportal.juniper.net/JSA75741Vendor Advisory
• https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:LThird Party Advisory
• https://supportportal.juniper.net/JSA75741Vendor Advisory
• https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:LThird Party Advisory

Published

Jan 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21594 A Heap-based Buffer Overflow vulnerability in the Network S…5.5
• CVE-2024-21595 An Improper Validation of Syntactic Correctness of Input vu…7.5
• CVE-2024-21596 A Heap-based Buffer Overflow vulnerability in the Routing P…5.3
• CVE-2024-21597 An Exposure of Resource to Wrong Sphere vulnerability in th…7.5
• CVE-2024-21598An Improper Validation of Syntactic Correctness of Input vul…8.7
• CVE-2024-21599 A Missing Release of Memory after Effective Lifetime vulner…6.5
• CVE-2024-21601 A Concurrent Execution using Shared Resource with Improper …5.9
• CVE-2024-21602 A NULL Pointer Dereference vulnerability in Juniper Network…7.5
• CVE-2024-21603 An Improper Check for Unusual or Exceptional Conditions vul…6.5
• CVE-2024-21604 An Allocation of Resources Without Limits or Throttling vul…7.5
• CVE-2024-21605An Exposure of Resource to Wrong Sphere vulnerability in the…7.1
• CVE-2024-21606 A Double Free vulnerability in the flow processing daemon (…7.5