Log in Start free

Vulnerability · Published Oct 16, 2020 · Assigned by juniper

CVE-2020-1657Junos OS: SRX Series: An attacker sending spoofed packets to IPSec peers may cause a Denial of Service.

High 7.5

In plain English

A high-severity security flaw in Junos OS from Juniper Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 29.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

On SRX Series devices, a vulnerability in the key-management-daemon (kmd) daemon of Juniper Networks Junos OS allows an attacker to spoof packets targeted to IPSec peers before a security association (SA) is established thereby causing a failure to set up the IPSec channel. Sustained receipt of these spoofed packets can cause a sustained Denial of Service (DoS) condition. This issue affects IPv4 and IPv6 implementations. This issue affects Juniper Networks Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D90; 15.1X49 versions prior to 15.1X49-D190; 17.4 versions prior to 17.4R2-S9, 17.4R3; 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3; 18.4 versions prior to 18.4R1-S6, 18.4R2-S3, 18.4R3; 19.1 versions prior to 19.1R1-S4, 19.1R2. This issue does not affect 12.3 or 15.1 releases which are non-SRX Series releases.

Affected products (as reported)

VendorProductVersions
Juniper Networks Junos OS 12.3X48 – before 12.3X48-D9015.1X49 – before 15.1X49-D19017.4 – before 17.4R2-S9, 17.4R318.1 – before 18.1R3-S918.2 – before 18.2R318.3 – before 18.3R1-S7, 18.3R2-S3, 18.3R318.4 – before 18.4R1-S6, 18.4R2-S3, 18.4R319.1 – before 19.1R1-S4, 19.1R2

Weakness: CWE-408 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References