CVE-2024-21591

The vulnerability results from the use of an unsafe function in the J-Web component, which allows an attacker to overwrite arbitrary memory areas of the device (arbitrary memory overwrite). An attacker operating over the network, without any authentication and user interaction, can craft an appropriate request leading to a buffer overflow write beyond boundaries (out-of-bounds write, CWE-787). Consequently, it is possible to take full control of the device or cause its unavailability.

An attacker can obtain root privileges on the device and take complete control of it by executing arbitrary code (RCE), or cause a denial of service (DoS) preventing proper device operation.

Junos OS should be updated as soon as possible to versions containing patches: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2, or 22.4R3 (and newer). If immediate patch deployment is not possible, it is recommended to disable access to the J-Web interface or restrict access to it only from trusted IP addresses.

Juniper Networks Junos OS on SRX Series and EX Series devices: versions prior to 20.4R3-S9; 21.2 prior to 21.2R3-S7; 21.3 prior to 21.3R3-S5; 21.4 prior to 21.4R3-S5; 22.1 prior to 22.1R3-S4; 22.2 prior to 22.2R3-S3; 22.3 prior to 22.3R3-S2; 22.4 prior to 22.4R2-S2 and 22.4R3.