CVE-2024-47489: Juniper Junos OS Evolved DoS Vulnerability

CVE-2024-47489 is a denial of service vulnerability in Juniper Junos OS Evolved on ACX Series devices caused by improper packet handling. Attackers can disrupt routing protocols and affect network connectivity. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-47489 Overview

CVE-2024-47489 is an Improper Handling of Exceptional Conditions vulnerability [CWE-755] in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX Series devices. An unauthenticated, network-based attacker can send specific transit protocol traffic that the Routing Engine (RE) incorrectly processes. This traffic fills the shared Distributed Denial of Service (DDoS) protection queue used by routing protocols, triggering protection violations and protocol flaps. The condition affects both IPv4 and IPv6 and does not require any specific routing protocol to be configured. The result is a partial Denial of Service (DoS) against downstream devices due to disrupted connectivity.

Critical Impact
Sustained transit traffic can cause routing protocol flaps on ACX Series routers, disrupting connectivity to downstream networking devices without authentication.

Affected Products

Juniper Junos OS Evolved on ACX Series (ACX5448, ACX5448-D, ACX5448-M)
Juniper Junos OS Evolved on ACX7020, ACX7024, ACX7024X, ACX710, ACX7100
Juniper Junos OS Evolved on ACX7300, ACX7509

Discovery Timeline

2024-10-11 - CVE-2024-47489 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47489

Vulnerability Analysis

The vulnerability originates in how the Packet Forwarding Engine on ACX Series devices classifies and forwards specific transit protocol packets. Instead of forwarding these packets on the data plane, the PFE punts them to the Routing Engine for processing. The Routing Engine handles these packets through the same DDoS protection queue used for legitimate control-plane routing protocol traffic.

Sustained receipt of the malformed transit flow saturates the shared queue. Once the DDoS policer threshold is exceeded, the system enforces violations that drop or delay legitimate routing protocol packets. Neighboring routers stop receiving expected hello or keepalive messages, causing protocol adjacencies to flap. The impact propagates as reachability loss to downstream devices dependent on those adjacencies.

Root Cause

The defect is an Improper Handling of Exceptional Conditions [CWE-755]. The PFE fails to classify specific transit packets as data-plane traffic and instead escalates them to the control plane. Combined with a shared queue design between transit exception handling and routing protocol processing, this creates a resource contention path exploitable from any reachable network position.

Attack Vector

An unauthenticated remote attacker sends crafted IPv4 or IPv6 transit protocol packets destined through an affected ACX router. No routing protocol needs to be enabled on the target, and no privileges or user interaction are required. Administrators can observe queue exhaustion using the following operational commands on Junos OS Evolved:

labuser@re0> show evo-pfemand host pkt-stats
labuser@re0> show host-path ddos all-policers

Output from show host-path ddos all-policers will show violations on the affected queue during exploitation.

Detection Methods for CVE-2024-47489

Indicators of Compromise

Unexpected increases in punted packet counts reported by show evo-pfemand host pkt-stats on ACX Series routers.
DDoS policer violations reported under show host-path ddos all-policers, particularly on queues shared by routing protocol traffic.
Routing protocol adjacency flaps (BGP, OSPF, IS-IS) correlated with transit traffic surges.
Sudden loss of reachability to downstream devices without corresponding link-state changes.

Detection Strategies

Baseline the normal punted-packet rate on ACX routers and alert on deviations from the DDoS policer counters.
Correlate routing protocol flap events in syslog with PFE host-path statistics to identify queue-driven disruptions.
Ingest Junos OS Evolved telemetry into a centralized SIEM or data lake for cross-device pattern analysis across the ACX fleet.

Monitoring Recommendations

Enable streaming telemetry for DDoS policer counters and export to a monitoring platform for continuous review.
Configure SNMP or gRPC alerts on protocol adjacency state changes involving ACX-terminated sessions.
Track NetFlow or sFlow records on upstream devices to identify sources of anomalous transit protocol traffic targeting ACX routers.

How to Mitigate CVE-2024-47489

Immediate Actions Required

Inventory ACX Series devices and identify Junos OS Evolved versions vulnerable per the Juniper advisory.
Schedule upgrades to a fixed release: 21.4R3-S8-EVO, 22.2R3-S4-EVO, 22.3R3-S4-EVO, 22.4R3-S3-EVO, 23.2R2-EVO, 23.4R1-S1-EVO, 23.4R2-EVO, 24.2R2-EVO, or later.
Monitor show host-path ddos all-policers output on production ACX devices for early signs of queue saturation.

Patch Information

Juniper Networks has released fixed versions of Junos OS Evolved that address CVE-2024-47489. Refer to the Juniper Support Portal for the associated security advisory and release notes. Upgrade any ACX Series device running an affected release to one of the fixed versions listed above.

Workarounds

Apply loopback firewall filters or control-plane policing to rate-limit transit protocol traffic destined to the Routing Engine on ACX devices.
Tune DDoS protection policer parameters to isolate abusive traffic classes from routing protocol queues where supported.
Restrict transit paths through ACX routers with edge filtering to reduce exposure until fixed software is deployed.

bash

# Verify DDoS protection queue status on Junos OS Evolved
show evo-pfemand host pkt-stats
show host-path ddos all-policers