CVE-2024-47490 Overview
CVE-2024-47490 is an Improper Restriction of Communication Channel to Intended Endpoints vulnerability [CWE-923] affecting the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS Evolved on ACX 7000 Series routers. An unauthenticated, network-based attacker can trigger resource exhaustion and cause a Denial of Service (DoS) by sending specific transit MPLS packets. The PFE incorrectly forwards these packets to the Routing Engine (RE) instead of handling them in the data plane. Continuous receipt of these MPLS packets exhausts RE resources. MPLS configuration is not required on the device for this issue to be exploitable.
Critical Impact
Continuous transit MPLS traffic can starve the Routing Engine of resources, degrading routing protocol stability and producing a sustained DoS condition on ACX 7000 Series platforms.
Affected Products
- Juniper Junos OS Evolved on ACX 7000 Series (ACX7020, ACX7024, ACX7024X, ACX7100, ACX7300, ACX7509)
- All versions before 21.4R3-S9-EVO; 22.2-EVO before 22.2R3-S4-EVO; 22.3-EVO before 22.3R3-S3-EVO
- 22.4-EVO before 22.4R3-S2-EVO; 23.2-EVO before 23.2R2-EVO; 23.4-EVO before 23.4R1-S1-EVO, 23.4R2-EVO
Discovery Timeline
- 2024-10-11 - CVE-2024-47490 published to NVD
- 2026-01-26 - Last updated in NVD database
Technical Details for CVE-2024-47490
Vulnerability Analysis
The vulnerability resides in how the Packet Forwarding Engine on ACX 7000 Series devices classifies specific transit MPLS packets. Instead of forwarding these packets along the data plane, the PFE punts them to the Routing Engine. The RE is intended to handle control-plane traffic, not high-volume transit packets. Sustained delivery of crafted MPLS packets drives RE CPU and memory consumption upward. The result is degraded responsiveness, potential routing protocol instability, and eventual denial of service.
This issue is exploitable without authentication and without any user interaction. Notably, the device does not need MPLS configured to be impacted, broadening the affected attack surface to any reachable ACX 7000 Series router running an unpatched Junos OS Evolved release.
Root Cause
The root cause is improper restriction of a communication channel between data plane and control plane components [CWE-923]. The PFE forwarding logic on ACX 7000 hardware does not correctly constrain which transit MPLS packets reach the RE. Packets that should be processed or dropped within the PFE are escalated to the RE, providing a remote attacker with a low-cost amplification primitive against the control plane.
Attack Vector
An unauthenticated attacker on any network path that reaches the device sends a continuous stream of the specific MPLS-encapsulated transit packets. Because no MPLS configuration is required on the target, internet-adjacent or transit-positioned ACX 7000 routers remain exposed even when MPLS services are not deployed. The attacker requires only network reachability to a routable interface, with no privileges and no user interaction. Refer to the Juniper Security Advisory JSA83009 for additional technical context.
Detection Methods for CVE-2024-47490
Indicators of Compromise
- Sustained high CPU or memory utilization on the Routing Engine without a corresponding increase in legitimate control-plane sessions.
- Unexpected punting of transit MPLS packets to the RE visible in PFE host-bound traffic counters.
- Routing protocol flaps (BGP, IS-IS, OSPF) or keepalive timeouts coinciding with elevated inbound MPLS traffic volumes.
Detection Strategies
- Monitor show system processes extensive and RE CPU/memory telemetry on ACX 7000 devices for sustained anomalies.
- Inspect host-bound packet counters and PFE-to-RE traffic statistics for elevated MPLS punt rates.
- Correlate NetFlow/IPFIX or sFlow data for inbound MPLS-labeled traffic spikes against affected ACX 7000 ingress interfaces.
Monitoring Recommendations
- Forward Junos OS Evolved syslog and streaming telemetry to a centralized analytics platform for baseline deviation detection.
- Set thresholds and alerts on RE CPU, memory, and host-bound queue depth metrics for ACX 7000 platforms.
- Track BGP/IS-IS/OSPF adjacency stability as a leading indicator of control-plane resource exhaustion.
How to Mitigate CVE-2024-47490
Immediate Actions Required
- Upgrade Junos OS Evolved to a fixed release as specified in the Juniper Security Advisory JSA83009.
- Inventory all ACX 7000 Series devices and confirm running software versions against the fixed-release list.
- Restrict untrusted network paths that can deliver arbitrary MPLS-labeled traffic to ACX 7000 ingress interfaces.
Patch Information
Juniper has released fixed versions: 21.4R3-S9-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R3-S2-EVO, 23.2R2-EVO, 23.4R1-S1-EVO, 23.4R2-EVO, and later. Operators should consult Juniper Security Advisory JSA83009 for the authoritative upgrade matrix and any interim guidance.
Workarounds
- Apply edge filtering or loopback firewall filters to drop unsolicited MPLS-labeled packets from untrusted sources where feasible.
- Limit MPLS-capable interfaces to trusted transit peers and disable MPLS family on interfaces facing untrusted networks.
- Implement control-plane policing and host-bound traffic rate limits to reduce RE exposure pending upgrade.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
