CVE-2024-47498

An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS). Several configuration statements meant to enforce limits on MAC learning and moves can be configured but do not take effect. This can lead to control plane overload situations which will severely impact the ability of the device to processes legitimate traffic. This issue affects Junos OS Evolved on QFX5000 Series: * All versions before 21.4R3-S8-EVO, * 22.2-EVO versions before 22.2R3-S5-EVO, * 22.4-EVO versions before 22.4R3-EVO, * 23.2-EVO versions before 23.2R2-EVO.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://supportportal.juniper.net/JSA88128

Configurations

No configuration.

History

15 Oct 2024, 12:58

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de característica no implementada o no compatible en la interfaz de usuario en la CLI de Juniper Networks Junos OS Evolved en la serie QFX5000 permite que un atacante adyacente no autenticado provoque una denegación de servicio (DoS). Se pueden configurar varias declaraciones de configuración destinadas a imponer límites en el aprendizaje y los movimientos de MAC, pero no surten efecto. Esto puede provocar situaciones de sobrecarga del plano de control que afectarán gravemente la capacidad del dispositivo para procesar tráfico legítimo. Este problema afecta a Junos OS Evolved en la serie QFX5000: * Todas las versiones anteriores a 21.4R3-S8-EVO, * Versiones 22.2-EVO anteriores a 22.2R3-S5-EVO, * Versiones 22.4-EVO anteriores a 22.4R3-EVO, * Versiones 23.2-EVO anteriores a 23.2R2-EVO.

11 Oct 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-11 16:15

Updated : 2024-10-15 12:58

NVD link : CVE-2024-47498

Mitre link : CVE-2024-47498

CVE.ORG link : CVE-2024-47498

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2024-47498", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "sirt@juniper.net", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "sirt@juniper.net", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 7.1, "automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "LOW", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "LOW", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "NONE", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-10-11T16:15:10.590", "references": [{"url": "https://supportportal.juniper.net/JSA88128", "source": "sirt@juniper.net"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unauthenticated, adjacent attacker to cause a Denial-of-Service (DoS).\n\nSeveral configuration statements meant to enforce limits on MAC learning and moves can be configured but do not take effect. This can lead to control plane overload situations which will severely impact the ability of the device to processes legitimate traffic.\n\n\n\nThis issue affects Junos OS Evolved on QFX5000 Series:\n\n\n\n * All versions before 21.4R3-S8-EVO,\n * 22.2-EVO versions before 22.2R3-S5-EVO,\n\n * 22.4-EVO versions before 22.4R3-EVO,\n * 23.2-EVO versions before 23.2R2-EVO."}, {"lang": "es", "value": "Una vulnerabilidad de caracter\u00edstica no implementada o no compatible en la interfaz de usuario en la CLI de Juniper Networks Junos OS Evolved en la serie QFX5000 permite que un atacante adyacente no autenticado provoque una denegaci\u00f3n de servicio (DoS). Se pueden configurar varias declaraciones de configuraci\u00f3n destinadas a imponer l\u00edmites en el aprendizaje y los movimientos de MAC, pero no surten efecto. Esto puede provocar situaciones de sobrecarga del plano de control que afectar\u00e1n gravemente la capacidad del dispositivo para procesar tr\u00e1fico leg\u00edtimo. Este problema afecta a Junos OS Evolved en la serie QFX5000: * Todas las versiones anteriores a 21.4R3-S8-EVO, * Versiones 22.2-EVO anteriores a 22.2R3-S5-EVO, * Versiones 22.4-EVO anteriores a 22.4R3-EVO, * Versiones 23.2-EVO anteriores a 23.2R2-EVO."}], "lastModified": "2024-10-15T12:58:51.050", "sourceIdentifier": "sirt@juniper.net"}