Junos OS: SRX and EX Series, MX240, MX480, MX960, QFX5120 Series: When web management is enabled for specific services an attacker may cause a CPU spike by sending genuine packets to the device

Summary

An Improper Following of Specification by Caller vulnerability in web management (J-Web, Captive Portal, 802.1X, Juniper Secure Connect (JSC) of Juniper Networks Junos OS on SRX Series, EX Series, MX240, MX480, MX960, QFX5120 Series, allows an unauthenticated, network-based attacker, sending genuine traffic targeted to the device to cause the CPU to climb until the device becomes unresponsive. Continuous receipt of these packets will create a sustained Denial of Service (DoS) condition. This issue affects Junos OS:  • All versions before 21.4R3-S9, • from 22.2 before 22.2R3-S5, • from 22.4 before 22.4R3-S4, • from 23.2 before 23.2R2-S3, • from 23.4 before 23.4R2-S3, • from 24.2 before 24.2R1-S1, 24.2R2. An indicator of compromise is to review the CPU % of the httpd process in the CLI: e.g.   show system processes extensive | match httpd  PID nobody       52   0   20M    191M select   2   0:01   80.00% httpd{httpd} <<<<< the percentage of httpd usage if high may be an indicator

Timeline

1. Apr 9, 2025, 7:51 PM UTCCVE published
2. Apr 10, 2025, 1:11 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Apr 15, 2025, 8:30 PM UTCRecord last updated

Affected versions

• AppWeb

  fixed in 21.4R3-S9; From 22.2 · fixed in 22.2R3-S5; From 22.4 · fixed in 22.4R3-S4; From 23.2 · fixed in 23.2R2-S3; From 23.4 · fixed in 23.4R2-S3

References 1