CVE-2024-21607: Juniper Junos IPv6 Filter Bypass Vulnerability

CVE-2024-21607 Overview

CVE-2024-21607 is a firewall filter bypass affecting Juniper Networks Junos OS on MX Series and EX9200 Series devices. When the tcp-reset option is added to a reject action in an IPv6 filter that matches on payload-protocol, the kernel filter permits packets instead of rejecting them. The payload-protocol match criteria is not supported in the kernel filter, causing it to accept all packets without further action. An unauthenticated, network-based attacker can leverage this misbehavior to bypass intended IPv6 access controls. The issue does not affect IPv4 firewall filters. Juniper tracks the flaw under advisory JSA75748 and classifies the weakness as [CWE-447] Unimplemented or Unsupported Feature in UI.

Critical Impact
IPv6 firewall filters configured with tcp-reset and payload-protocol silently permit traffic that operators intend to block, exposing downstream services to unauthenticated network traffic.

Affected Products

Juniper Networks Junos OS on MX Series (MX5, MX10, MX40, MX80, MX104, MX150, MX204, MX240, MX304, MX480, MX960, MX2008, MX2010, MX2020, MX10000 family)
Juniper Networks Junos OS on EX9200 Series (EX9200, EX9204, EX9208)
All Junos OS versions earlier than 20.4R3-S7, and 21.1, 21.2, 21.3, 21.4, 22.1, 22.2, 22.3, and 22.4 branches prior to fixed releases listed in JSA75748

Discovery Timeline

2024-01-12 - CVE-2024-21607 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21607

Vulnerability Analysis

Junos OS accepts stateless firewall filter configurations that combine an IPv6 term matching on payload-protocol with a reject action using the tcp-reset modifier. The compiled kernel filter, however, does not implement the payload-protocol match. Rather than failing closed, the kernel filter treats packets as unmatched and defaults to accepting them. Operators auditing configuration syntax see a valid reject tcp-reset term, but the datapath silently forwards the traffic. The fix aligns kernel behavior with the control plane by treating payload-protocol as equivalent to next-header, restoring the intended reject semantics.

Root Cause

The root cause is a feature parity gap between the Junos CLI and the kernel firewall filter compiler. The CLI accepts payload-protocol as a valid match keyword in IPv6 filters, but the kernel filter has no handler for it. Combined with a reject action carrying the tcp-reset option, the unhandled match causes the term to be ignored. The vulnerability is classified as [CWE-447] Unimplemented or Unsupported Feature in UI, reflecting the mismatch between advertised configuration options and enforced datapath behavior.

Attack Vector

Exploitation requires no authentication and no user interaction. A remote attacker sends IPv6 traffic that should be dropped by a filter term written as then reject tcp-reset with a from payload-protocol clause. Because the kernel filter bypasses the term, the packets traverse the device and reach protected destinations. The impact is limited to integrity of the filtering policy rather than confidentiality or availability of the router itself. Networks that rely on IPv6 stateless filters to enforce segmentation or protocol restrictions are directly exposed.

No public proof-of-concept code is available. See the Juniper Security Advisory JSA75748 for authoritative technical details on the filter behavior.

Detection Methods for CVE-2024-21607

Indicators of Compromise

Unexpected IPv6 flows reaching destinations that should be blocked by reject tcp-reset terms with payload-protocol matches.
Interface or flow counters showing IPv6 traffic that does not increment the corresponding firewall filter reject counters.
Absence of expected ICMPv6 or TCP RST responses generated by a reject action on filtered IPv6 traffic.

Detection Strategies

Audit running Junos configurations for IPv6 firewall filters containing both from payload-protocol and then reject tcp-reset, and correlate against the vulnerable versions listed in JSA75748.
Perform active validation by sending IPv6 test traffic that should be dropped by affected filters and confirming that the datapath actually rejects it.
Compare filter term hit counters (show firewall filter <name>) against interface traffic statistics to identify silent bypass patterns.

Monitoring Recommendations

Forward Junos syslog and firewall counters to a centralized analytics platform and alert on IPv6 flows that violate documented segmentation policy.
Enable flow telemetry (for example, IPFIX or Jflow) on MX and EX9200 devices to baseline IPv6 traffic and identify traffic that bypasses expected filters.
Track the EPSS score for CVE-2024-21607 (currently 0.308%) and re-evaluate exposure if it rises materially.

How to Mitigate CVE-2024-21607

Immediate Actions Required

Inventory all MX Series and EX9200 Series devices and identify those running Junos OS versions listed as vulnerable in JSA75748.
Review IPv6 firewall filter configurations for terms combining payload-protocol matches with reject tcp-reset actions and prioritize their remediation.
Schedule upgrades to fixed Junos OS releases: 20.4R3-S7, 21.1R3-S5, 21.2R3-S5, 21.3R3-S4, 21.4R3-S4, 22.1R3-S2, 22.2R3-S2, 22.3R2-S2 or 22.3R3, 22.4R1-S2, 22.4R2-S2, 22.4R3, or later.

Patch Information

Juniper Networks has released fixed Junos OS builds addressing CVE-2024-21607. Refer to the Juniper Security Advisory JSA75748 for the complete list of fixed releases per branch and download instructions. Upgrading to a fixed release aligns kernel filter behavior with control-plane configuration by handling payload-protocol as next-header.

Workarounds

Rewrite affected IPv6 filter terms to use next-header instead of payload-protocol so the kernel filter enforces the intended action.
Remove the tcp-reset modifier and use a plain reject or discard action where operationally acceptable until upgrades are complete.
Layer defense with upstream IPv6 access control lists on adjacent devices to enforce segmentation independently of the affected Junos filter.

bash

# Example: replace payload-protocol with next-header in an IPv6 filter
set firewall family inet6 filter BLOCK-TCP term BLOCK from next-header tcp
set firewall family inet6 filter BLOCK-TCP term BLOCK then reject tcp-reset
delete firewall family inet6 filter BLOCK-TCP term BLOCK from payload-protocol
commit and-quit