CVE-2024-21607

An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to cause partial impact to the integrity of the device. If the "tcp-reset" option is added to the "reject" action in an IPv6 filter which matches on "payload-protocol", packets are permitted instead of rejected. This happens because the payload-protocol match criteria is not supported in the kernel filter causing it to accept all packets without taking any other action. As a fix the payload-protocol match will be treated the same as a "next-header" match to avoid this filter bypass. This issue doesn't affect IPv4 firewall filters. This issue affects Juniper Networks Junos OS on MX Series and EX9200 Series: * All versions earlier than 20.4R3-S7; * 21.1 versions earlier than 21.1R3-S5; * 21.2 versions earlier than 21.2R3-S5; * 21.3 versions earlier than 21.3R3-S4; * 21.4 versions earlier than 21.4R3-S4; * 22.1 versions earlier than 22.1R3-S2; * 22.2 versions earlier than 22.2R3-S2; * 22.3 versions earlier than 22.3R2-S2, 22.3R3; * 22.4 versions earlier than 22.4R1-S2, 22.4R2-S2, 22.4R3.

• CWE-447

• https://supportportal.juniper.net/JSA75748Vendor Advisory
• https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NThird Party Advisory
• https://supportportal.juniper.net/JSA75748Vendor Advisory
• https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NThird Party Advisory

Published

Jan 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21601 A Concurrent Execution using Shared Resource with Improper …5.9
• CVE-2024-21602 A NULL Pointer Dereference vulnerability in Juniper Network…7.5
• CVE-2024-21603 An Improper Check for Unusual or Exceptional Conditions vul…6.5
• CVE-2024-21604 An Allocation of Resources Without Limits or Throttling vul…7.5
• CVE-2024-21605An Exposure of Resource to Wrong Sphere vulnerability in the…7.1
• CVE-2024-21606 A Double Free vulnerability in the flow processing daemon (…7.5
• CVE-2024-21609A Missing Release of Memory after Effective Lifetime vulnera…7.1
• CVE-2024-2161Use of Hard-coded Credentials in Kiloview NDI allows un-auth…9.8
• CVE-2024-21610An Improper Handling of Exceptional Conditions vulnerability…4.3
• CVE-2024-21611 A Missing Release of Memory after Effective Lifetime vulner…7.5
• CVE-2024-21612 An Improper Handling of Syntactically Invalid Structure…7.5
• CVE-2024-21613 A Missing Release of Memory after Effective Lifetime vulner…6.5