CVE-2024-21591

CVSS V2 None CVSS V3 None

Description

An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device. This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory. This issue affects Juniper Networks Junos OS SRX Series and EX Series: * Junos OS versions earlier than 20.4R3-S9; * Junos OS 21.2 versions earlier than 21.2R3-S7; * Junos OS 21.3 versions earlier than 21.3R3-S5; * Junos OS 21.4 versions earlier than 21.4R3-S5; * Junos OS 22.1 versions earlier than 22.1R3-S4; * Junos OS 22.2 versions earlier than 22.2R3-S3; * Junos OS 22.3 versions earlier than 22.3R3-S2; * Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.

Overview

CVE ID
CVE-2024-21591

Assigner
juniper

Vulnerability Status
PUBLISHED

Published Version
2024-01-12T00:52:04.028Z

Last Modified Date
2024-02-09T23:35:58.570Z

Weakness Enumerations

CWE	URL
CWE-787	http://cwe.mitre.org/data/definitions/787.html

References

Reference URL	Reference Tags
https://supportportal.juniper.net/JSA75729	vendor-advisory
https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	technical-description
https://curesec.com/blog/article/CVE-2024-21591_Juniper_Remote_Code_Exec.html	third-party-advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-21591
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21591

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 15:25:30				Added to TrackCVE