CVE-2024-39537

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved on ACX 7000 Series allows an unauthenticated, network-based attacker to cause a limited information disclosure and availability impact to the device. Due to a wrong initialization, specific processes which should only be able to communicate internally within the device can be reached over the network via open ports. This issue affects Junos OS Evolved on ACX 7000 Series: * All versions before 21.4R3-S7-EVO, * 22.2-EVO versions before 22.2R3-S4-EVO, * 22.3-EVO versions before 22.3R3-S3-EVO, * 22.4-EVO versions before 22.4R3-S2-EVO, * 23.2-EVO versions before 23.2R2-EVO, * 23.4-EVO versions before 23.4R1-S1-EVO, 23.4R2-EVO.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://supportportal.juniper.net/JSA82997
https://supportportal.juniper.net/JSA82997

Configurations

No configuration.

History

21 Nov 2024, 09:27

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de restricción inadecuada del canal de comunicación a los endpoints previstos en Juniper Networks Junos OS evolucionado en la serie ACX 7000 permite que un atacante no autenticado basado en la red cause una divulgación de información limitada y un impacto en la disponibilidad del dispositivo. Debido a una inicialización incorrecta, a través de puertos abiertos se puede acceder a través de la red a procesos específicos que sólo deberían poder comunicarse internamente dentro del dispositivo. Este problema afecta a Junos OS Evolved en la serie ACX 7000: * Todas las versiones anteriores a 21.4R3-S7-EVO, * Versiones 22.2-EVO anteriores a 22.2R3-S4-EVO, * Versiones 22.3-EVO anteriores a 22.3R3-S3-EVO, * 22.4 -Versiones EVO anteriores a 22.4R3-S2-EVO, versiones 23.2-EVO anteriores a 23.2R2-EVO, versiones 23.4-EVO anteriores a 23.4R1-S1-EVO, 23.4R2-EVO.
References	~~() https://supportportal.juniper.net/JSA82997 -~~	() https://supportportal.juniper.net/JSA82997 -

11 Jul 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-11 17:15

Updated : 2024-11-21 09:27

NVD link : CVE-2024-39537

Mitre link : CVE-2024-39537

CVE.ORG link : CVE-2024-39537

JSON object : View

Products Affected

No product.

CWE

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

6.5 /10