CVE-2024-30389

An Incorrect Behavior Order vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on EX4300 Series allows an unauthenticated, network-based attacker to cause an integrity impact to networks downstream of the vulnerable device. When an output firewall filter is applied to an interface it doesn't recognize matching packets but permits any traffic. This issue affects Junos OS 21.4 releases from 21.4R1 earlier than 21.4R3-S6. This issue does not affect Junos OS releases earlier than 21.4R1.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://supportportal.juniper.net/JSA79185	Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N	Issue Tracking
http://supportportal.juniper.net/JSA79185	Vendor Advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N	Issue Tracking

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:juniper:junos:21.4:r1::::::
	cpe:2.3:o:juniper:junos:21.4:r1-s1::::::
	cpe:2.3:o:juniper:junos:21.4:r1-s2::::::
	cpe:2.3:o:juniper:junos:21.4:r2::::::
	cpe:2.3:o:juniper:junos:21.4:r2-s1::::::
	cpe:2.3:o:juniper:junos:21.4:r2-s2::::::
	cpe:2.3:o:juniper:junos:21.4:r3::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s1::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s2::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s3::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s4::::::
	cpe:2.3:o:juniper:junos:21.4:r3-s5::::::

OR	cpe:2.3:h:juniper:ex4300:-:::::::*
	cpe:2.3:h:juniper:ex4300-24p:-:::::::*
	cpe:2.3:h:juniper:ex4300-24p-s:-:::::::*
	cpe:2.3:h:juniper:ex4300-24t:-:::::::*
	cpe:2.3:h:juniper:ex4300-24t-s:-:::::::*
	cpe:2.3:h:juniper:ex4300-32f:-:::::::*
	cpe:2.3:h:juniper:ex4300-32f-dc:-:::::::*
	cpe:2.3:h:juniper:ex4300-32f-s:-:::::::*
	cpe:2.3:h:juniper:ex4300-48mp:-:::::::*
	cpe:2.3:h:juniper:ex4300-48mp-s:-:::::::*
	cpe:2.3:h:juniper:ex4300-48p:-:::::::*
	cpe:2.3:h:juniper:ex4300-48p-s:-:::::::*
	cpe:2.3:h:juniper:ex4300-48t:-:::::::*
	cpe:2.3:h:juniper:ex4300-48t-afi:-:::::::*
	cpe:2.3:h:juniper:ex4300-48t-dc:-:::::::*
	cpe:2.3:h:juniper:ex4300-48t-dc-afi:-:::::::*
	cpe:2.3:h:juniper:ex4300-48t-s:-:::::::*

History

06 Feb 2025, 20:36

Type	Values Removed	Values Added
References	~~() http://supportportal.juniper.net/JSA79185 -~~	() http://supportportal.juniper.net/JSA79185 - Vendor Advisory
References	~~() https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N -~~	() https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Issue Tracking
First Time		Juniper ex4300-48mp Juniper ex4300-48t-dc-afi Juniper ex4300-48p Juniper ex4300-48t-dc Juniper junos Juniper ex4300-48t-s Juniper ex4300-24p-s Juniper Juniper ex4300 Juniper ex4300-48t Juniper ex4300-48p-s Juniper ex4300-24p Juniper ex4300-48mp-s Juniper ex4300-32f-s Juniper ex4300-24t Juniper ex4300-32f Juniper ex4300-48t-afi Juniper ex4300-24t-s Juniper ex4300-32f-dc
CWE		NVD-CWE-Other
CPE		cpe:2.3:h:juniper:ex4300-24p-s:-:::::::* cpe:2.3:o:juniper:junos:21.4:r3-s2:::::: cpe:2.3:h:juniper:ex4300-48mp-s:-:::::::* cpe:2.3:o:juniper:junos:21.4:r2:::::: cpe:2.3:h:juniper:ex4300-24t-s:-:::::::* cpe:2.3:h:juniper:ex4300-48t-afi:-:::::::* cpe:2.3:h:juniper:ex4300-48t:-:::::::* cpe:2.3:h:juniper:ex4300-48mp:-:::::::* cpe:2.3:o:juniper:junos:21.4:r3-s3:::::: cpe:2.3:h:juniper:ex4300-32f:-:::::::* cpe:2.3:o:juniper:junos:21.4:r3-s1:::::: cpe:2.3:h:juniper:ex4300-48t-dc-afi:-:::::::* cpe:2.3:o:juniper:junos:21.4:r3-s5:::::: cpe:2.3:o:juniper:junos:21.4:r1:::::: cpe:2.3:h:juniper:ex4300-24p:-:::::::* cpe:2.3:o:juniper:junos:21.4:r3:::::: cpe:2.3:h:juniper:ex4300:-:::::::* cpe:2.3:h:juniper:ex4300-32f-dc:-:::::::* cpe:2.3:h:juniper:ex4300-48t-s:-:::::::* cpe:2.3:h:juniper:ex4300-48p-s:-:::::::* cpe:2.3:o:juniper:junos:21.4:r2-s2:::::: cpe:2.3:h:juniper:ex4300-48t-dc:-:::::::* cpe:2.3:o:juniper:junos:21.4:r3-s4:::::: cpe:2.3:o:juniper:junos:21.4:r2-s1:::::: cpe:2.3:h:juniper:ex4300-24t:-:::::::* cpe:2.3:h:juniper:ex4300-48p:-:::::::* cpe:2.3:o:juniper:junos:21.4:r1-s1:::::: cpe:2.3:o:juniper:junos:21.4:r1-s2:::::: cpe:2.3:h:juniper:ex4300-32f-s:-:::::::*

21 Nov 2024, 09:11

Type	Values Removed	Values Added
References	~~() http://supportportal.juniper.net/JSA79185 -~~	() http://supportportal.juniper.net/JSA79185 -
References	~~() https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N -~~	() https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N -

16 May 2024, 21:16

Type	Values Removed	Values Added
Summary	(en) An Incorrect Behavior Order vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on EX4300 Series allows an unauthenticated, network-based attacker to cause an integrity impact to networks downstream of the vulnerable device. When an output firewall filter is applied to an interface it doesn't recognize matching packets but permits any traffic. This issue affects Junos OS 21.4 releases from 21.4R1 earlier than 21.4R3-S6. This issue does not affect Junos OS releases earlier than 21.4R1.	(en) An Incorrect Behavior Order vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on EX4300 Series allows an unauthenticated, network-based attacker to cause an integrity impact to networks downstream of the vulnerable device. When an output firewall filter is applied to an interface it doesn't recognize matching packets but permits any traffic. This issue affects Junos OS 21.4 releases from 21.4R1 earlier than 21.4R3-S6. This issue does not affect Junos OS releases earlier than 21.4R1.

15 Apr 2024, 13:15

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de orden de comportamiento incorrecto en el motor de reenvío de paquetes (PFE) de Juniper Networks Junos OS en la serie EX4300 permite que un atacante basado en red no autenticado cause un impacto en la integridad de las redes posteriores al dispositivo vulnerable. Cuando se aplica un filtro de firewall de salida a una interfaz, no reconoce los paquetes coincidentes pero permite cualquier tráfico. Este problema afecta a las versiones Junos OS 21.4 desde 21.4R1 anteriores a 21.4R3-S6. Este problema no afecta a las versiones de Junos OS anteriores a la 21.4R1.

12 Apr 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-04-12 16:15

Updated : 2025-02-06 20:36

NVD link : CVE-2024-30389

Mitre link : CVE-2024-30389

CVE.ORG link : CVE-2024-30389

JSON object : View

Products Affected

juniper

ex4300-48mp
ex4300-48t
ex4300-48mp-s
junos
ex4300-48t-dc
ex4300
ex4300-24p
ex4300-48p-s
ex4300-48t-s
ex4300-48p
ex4300-32f-dc
ex4300-48t-afi
ex4300-24t-s
ex4300-48t-dc-afi
ex4300-32f
ex4300-32f-s
ex4300-24p-s
ex4300-24t

CWE

CWE-696

Incorrect Behavior Order

NVD-CWE-Other

{"id": "CVE-2024-30389", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 6.9, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "LOW", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-04-12T16:15:38.317", "references": [{"url": "http://supportportal.juniper.net/JSA79185", "tags": ["Vendor Advisory"], "source": "sirt@juniper.net"}, {"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "tags": ["Issue Tracking"], "source": "sirt@juniper.net"}, {"url": "http://supportportal.juniper.net/JSA79185", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "sirt@juniper.net", "description": [{"lang": "en", "value": "CWE-696"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "An Incorrect Behavior Order vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on EX4300 Series allows an unauthenticated, network-based attacker to cause an integrity impact to networks downstream of the vulnerable device.\n\nWhen an output firewall filter is applied to an interface it doesn't recognize matching packets but permits any traffic.\nThis issue affects Junos OS 21.4 releases from 21.4R1 earlier than 21.4R3-S6.\nThis issue does not affect Junos OS releases earlier than 21.4R1."}, {"lang": "es", "value": "Una vulnerabilidad de orden de comportamiento incorrecto en el motor de reenv\u00edo de paquetes (PFE) de Juniper Networks Junos OS en la serie EX4300 permite que un atacante basado en red no autenticado cause un impacto en la integridad de las redes posteriores al dispositivo vulnerable. Cuando se aplica un filtro de firewall de salida a una interfaz, no reconoce los paquetes coincidentes pero permite cualquier tr\u00e1fico. Este problema afecta a las versiones Junos OS 21.4 desde 21.4R1 anteriores a 21.4R3-S6. Este problema no afecta a las versiones de Junos OS anteriores a la 21.4R1."}], "lastModified": "2025-02-06T20:36:23.717", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:juniper:junos:21.4:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4310D2D9-A8A6-48F8-9384-0A0692A1E1C3"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r1-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9962B01C-C57C-4359-9532-676AB81CE8B0"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r1-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62178549-B679-4902-BFDB-2993803B7FCE"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AD697DF-9738-4276-94ED-7B9380CD09F5"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r2-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09FF5818-0803-4646-A386-D7C645EE58A3"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r2-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2229FA59-EB24-49A2-85CE-F529A8DE6BA7"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CB280D8-C5D8-4B51-A879-496ACCDE4538"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F3F54F1-75B3-400D-A735-2C27C8CEBE79"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "476A49E7-37E9-40F9-BF2D-9BBFFAA1DFFC"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A5B196A-2AF1-4AE5-9148-A75A572807BC"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B457616-2D91-4913-9A7D-038BBF8F1F66"}, {"criteria": "cpe:2.3:o:juniper:junos:21.4:r3-s5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C470FB4E-A927-4AF3-ACB0-AD1E264218B7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E594D6DC-87F6-40D2-8268-ED6021462168"}, {"criteria": "cpe:2.3:h:juniper:ex4300-24p:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7BEA4BC3-093F-4DE6-BED1-2C7D2FC2C8A5"}, {"criteria": "cpe:2.3:h:juniper:ex4300-24p-s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "592377CC-4044-4FDD-A3DF-CBF25754EE4D"}, {"criteria": "cpe:2.3:h:juniper:ex4300-24t:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D12E8275-EF6B-44F9-A7D8-A769CDB5EED5"}, {"criteria": "cpe:2.3:h:juniper:ex4300-24t-s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D3E63215-246E-49F3-A537-8A90D512DAB0"}, {"criteria": "cpe:2.3:h:juniper:ex4300-32f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "AD1A5E69-928A-41A0-8B9B-91F307D99854"}, {"criteria": "cpe:2.3:h:juniper:ex4300-32f-dc:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2B71953D-016D-4E72-B598-55667A507681"}, {"criteria": "cpe:2.3:h:juniper:ex4300-32f-s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CABBC37B-EB93-424D-A1E7-4686039C0955"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48mp:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "24526B69-E3E3-4249-80A4-A886BED5C07E"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48mp-s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B2209605-65B6-44B3-9700-9EC543BF2408"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48p:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C3C348CF-65C1-4A53-8F4F-99B5A4113679"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48p-s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "60CB5F91-DC40-4D09-BB93-4539B8581877"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48t:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "ADE8EB69-95DD-44E9-80A6-F2B5E34BBD5B"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48t-afi:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EEEDB14F-E74A-4C48-A969-1D22D7F7C7C8"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48t-dc:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CBE3866E-109E-479F-9FFE-3F6E81C0DE7C"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48t-dc-afi:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8A17D793-5F01-4818-956D-D6BC5A6C4CEE"}, {"criteria": "cpe:2.3:h:juniper:ex4300-48t-s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "EF4C3E8E-C8B4-42A5-8DB6-7E8114FCC030"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "sirt@juniper.net"}

5.8 /10