CVE-2024-30391

A Missing Authentication for Critical Function vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated network-based attacker to cause limited impact to the integrity or availability of the device. If a device is configured with IPsec authentication algorithm hmac-sha-384 or hmac-sha-512, tunnels are established normally but for traffic traversing the tunnel no authentication information is sent with the encrypted data on egress, and no authentication information is expected on ingress. So if the peer is an unaffected device transit traffic is going to fail in both directions. If the peer is an also affected device transit traffic works, but without authentication, and configuration and CLI operational commands indicate authentication is performed. This issue affects Junos OS: * All versions before 20.4R3-S7, * 21.1 versions before 21.1R3,  * 21.2 versions before 21.2R2-S1, 21.2R3,  * 21.3 versions before 21.3R1-S2, 21.3R2.

• CWE-306
• CWE-306

• http://supportportal.juniper.net/JSA79188Vendor Advisory
• https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NNot Applicable
• http://supportportal.juniper.net/JSA79188Vendor Advisory
• https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NNot Applicable

Published

Apr 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-30386A Use-After-Free vulnerability in the Layer 2 Address Learni…7.1
• CVE-2024-30387A Missing Synchronization vulnerability in the Packet Forwar…7.1
• CVE-2024-30388An Improper Isolation or Compartmentalization vulnerability …7.1
• CVE-2024-30389An Incorrect Behavior Order vulnerability in the Packet Forw…6.9
• CVE-2024-3039A vulnerability classified as critical has been found in Sha…9.8
• CVE-2024-30390An Improper Restriction of Excessive Authentication Attempts…6.9
• CVE-2024-30392A Stack-based Buffer Overflow vulnerability in Flow Processi…8.7
• CVE-2024-30394A Stack-based Buffer Overflow vulnerability in the Routing P…8.7
• CVE-2024-30395An Improper Validation of Specified Type of Input vulnerabil…8.7
• CVE-2024-30397An Improper Check for Unusual or Exceptional Conditions vuln…8.7
• CVE-2024-30398An Improper Restriction of Operations within the Bounds of a…8.7
• CVE-2024-3040A vulnerability, which was classified as critical, was found…9.8