Log in Start free

Vulnerability · Published Apr 22, 2021 · Assigned by juniper

CVE-2021-0249Junos OS: SRX Series: A remote attacker may be able to cause a PFE buffer overflow to arbitrarily remotely execute code or commands on the target device with UTM enabled.

High 8.1

In plain English

A high-severity buffer overflow in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.8%top 20.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

On SRX Series devices configured with UTM services a buffer overflow vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS may allow an attacker to arbitrarily execute code or commands on the target to take over or otherwise impact the device by sending crafted packets to or through the device. This issue affects: Juniper Networks Junos OS on SRX Series: 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9; 17.4R3 and later versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S1; 18.3 versions prior to 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S4, 19.1R2; 19.2 versions prior to 19.2R1-S1, 19.2R2. An indicator of compromise can be the following text in the UTM log: RT_UTM: AV_FILE_NOT_SCANNED_PASSED_MT:

Affected products (as reported)

VendorProductVersions
Juniper Networks Junos OS 15.1X49 – before 15.1X49-D19017.4 – before 17.4R2-S918.1 – before 18.1R3-S918.2 – before 18.2R3-S118.3 – before 18.3R2-S3, 18.3R318.4 – before 18.4R2-S3, 18.4R319.1 – before 19.1R1-S4, 19.1R219.2 – before 19.2R1-S1, 19.2R2

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References