CVE-2024-21586: Juniper Junos DoS Vulnerability

CVE-2024-21586 Overview

CVE-2024-21586 is an Improper Check for Unusual or Exceptional Conditions vulnerability (CWE-754) in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS running on SRX Series and NFX Series devices. This vulnerability allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS) condition by sending specific valid traffic destined to the affected device.

When an affected device receives the specially crafted traffic, it causes the PFE to crash and restart. If an attacker continues to send this malicious traffic, it creates a sustained DoS condition that can severely impact network availability and security operations.

Critical Impact

Unauthenticated attackers can remotely crash Juniper SRX and NFX Series devices, causing sustained service disruption to critical network security infrastructure.

Affected Products

• Juniper Junos OS 21.4 versions before 21.4R3-S7.9 (SRX Series) / 21.4R3-S8 (NFX Series)
• Juniper Junos OS 22.1 versions before 22.1R3-S5.3 (SRX Series) / after 22.1R1 (NFX Series)
• Juniper Junos OS 22.2 versions before 22.2R3-S4.11 (SRX Series) / 22.2R3-S5 (NFX Series)
• Juniper Junos OS 22.3 versions before 22.3R3
• Juniper Junos OS 22.4 versions before 22.4R3
• Juniper SRX Series (SRX300, SRX320, SRX340, SRX345, SRX380, SRX1500, SRX1600, SRX2300, SRX4100, SRX4120, SRX4200, SRX4300, SRX4600, SRX4700, SRX5400, SRX5600, SRX5800)
• Juniper NFX Series (NFX150, NFX250, NFX350)

Discovery Timeline

• July 1, 2024 - CVE-2024-21586 published to NVD
• January 22, 2026 - Last updated in NVD database

Technical Details for CVE-2024-21586

Vulnerability Analysis

This vulnerability exists in the Packet Forwarding Engine (PFE), a critical component of Juniper's SRX and NFX Series devices responsible for processing and forwarding network traffic. The PFE handles packet processing at the hardware level, making it essential for the device's core functionality as a security gateway.

The vulnerability stems from improper handling of exceptional conditions when processing certain valid network traffic. Unlike typical DoS vulnerabilities that rely on malformed packets, this issue is triggered by specific but legitimate traffic patterns, making it particularly concerning as the traffic may not be flagged by traditional security filters.

When exploited, the PFE component crashes and initiates an automatic restart sequence. During this restart period, the device cannot process traffic, creating a service outage. The impact is amplified because SRX Series firewalls and NFX Series Network Functions Virtualization platforms often serve as critical security perimeter devices.

Junos OS versions prior to 21.4R1 are not affected by this vulnerability.

Root Cause

The root cause is classified as CWE-754: Improper Check for Unusual or Exceptional Conditions. The PFE component fails to properly validate and handle certain edge cases in network traffic processing. When specific valid traffic patterns are processed, the PFE encounters an unhandled exception that triggers a crash rather than gracefully handling the condition.

This type of vulnerability typically occurs when input validation routines do not account for all possible valid input combinations, or when error handling code paths are incomplete. In network device firmware, such oversights can be particularly dangerous as they directly impact the device's ability to maintain network availability.

Attack Vector

The attack can be executed remotely over the network without authentication. An attacker needs only the ability to send network traffic to the affected device. The attack characteristics include:

The vulnerability is exploited by sending specific valid traffic destined directly to the device. The traffic does not need to be malformed, making detection more challenging. Once the PFE crashes and restarts, the attacker can continue sending the triggering traffic to maintain a sustained denial of service condition.

The attack does not require any user interaction and can be executed against any network-reachable SRX or NFX device running a vulnerable Junos OS version.

Detection Methods for CVE-2024-21586

Indicators of Compromise

• Unexpected PFE crash events in system logs with entries indicating abnormal termination
• Repeated device reboots or restart cycles within short time periods
• Syslog messages indicating fpc or pfe process failures
• Traffic processing interruptions coinciding with inbound traffic from specific sources

Detection Strategies

• Monitor system logs for PFE crash indicators using SIEM correlation rules targeting crash/restart patterns
• Implement network monitoring to detect traffic patterns preceding device restarts
• Configure SNMP traps to alert on device reload events and FPC failures
• Review Junos OS system core dump files for PFE-related crash signatures

Monitoring Recommendations

• Enable detailed logging on SRX/NFX devices with centralized log collection to preserve evidence during attacks
• Implement baseline monitoring for device uptime and restart frequency to identify anomalies
• Deploy network flow analysis to correlate unusual traffic patterns with device stability issues
• Configure automated alerting for multiple PFE restart events within defined time windows

How to Mitigate CVE-2024-21586

Immediate Actions Required

• Identify all SRX and NFX Series devices in your environment running vulnerable Junos OS versions
• Prioritize patching for devices exposed to untrusted networks or serving critical security functions
• Review and restrict network access to device management interfaces where possible
• Implement monitoring for PFE crash events as an early warning indicator

Patch Information

Juniper Networks has released fixed versions of Junos OS to address this vulnerability. Organizations should upgrade to the following versions or later:

SRX Series:

• 21.4R3-S7.9 or later
• 22.1R3-S5.3 or later
• 22.2R3-S4.11 or later
• 22.3R3 or later
• 22.4R3 or later

NFX Series:

• 21.4R3-S8 or later
• 22.2R3-S5 or later
• 22.3R3 or later
• 22.4R3 or later

For detailed patch information and download links, refer to the Juniper Security Advisory JSA83195.

Workarounds

• No specific workarounds have been published by Juniper for this vulnerability; patching is the recommended remediation
• Implement network segmentation to limit exposure of affected devices to untrusted traffic sources
• Consider deploying rate limiting or traffic filtering upstream of affected devices as a temporary measure
• Monitor affected devices closely for signs of exploitation while planning upgrade schedules

# Verify current Junos OS version
show version

# Check for PFE crashes in system logs
show log messages | match "fpc|pfe|crash|restart"

# Review system uptime for unexpected restarts
show system uptime