CVE-2024-47497: Juniper Junos DoS Vulnerability

CVE-2024-47497 Overview

CVE-2024-47497 is an Uncontrolled Resource Consumption vulnerability [CWE-400] in the HTTP daemon (httpd) of Juniper Networks Junos OS. The flaw affects SRX Series, QFX Series, MX Series, and EX Series devices. An unauthenticated, network-based attacker can send specific HTTPS connection requests that trigger creation of processes that never terminate properly. Over time, these orphaned processes exhaust system resources, causing the device to crash and restart. The vulnerability carries a CVSS 4.0 score of 8.7 (HIGH) and impacts core routing, switching, and security infrastructure deployed by enterprises and service providers.

Critical Impact

Remote, unauthenticated attackers can crash and restart Juniper Junos OS devices by exhausting httpd-spawned process resources, disrupting network operations across SRX, QFX, MX, and EX Series platforms.

Affected Products

• Juniper Junos OS on SRX Series (SRX300–SRX5800, SRX1500/1600/2300, SRX4100–SRX4700)
• Juniper Junos OS on EX Series (EX2300, EX3400, EX4000–EX4650, EX9204–EX9214)
• Juniper Junos OS on MX Series and QFX Series (MX204–MX2020, QFX5110–QFX5700, QFX10002–QFX10016)

Discovery Timeline

• 2024-10-11 - CVE-2024-47497 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2024-47497

Vulnerability Analysis

The vulnerability resides in the Junos OS HTTP daemon (httpd), which handles management traffic on affected platforms. When an attacker sends crafted HTTPS connection requests, the daemon spawns handler processes that are not properly cleaned up. These orphaned processes accumulate in the process table and consume memory, file descriptors, and CPU cycles. Administrators can observe the leak using the command show system processes extensive | match mgd | count, which reveals an unbounded growth in mgd process instances. The attacker requires no credentials and no user interaction, making the issue trivially reachable on any device exposing HTTPS management to an untrusted network.

Root Cause

The root cause is improper lifecycle management of processes spawned by httpd when handling HTTPS connection requests, classified as Uncontrolled Resource Consumption [CWE-400]. Each qualifying request leaks a process, and Junos OS does not enforce a bound on the number of concurrent or orphaned handlers. Resource exhaustion eventually destabilizes the management plane and triggers a device crash and restart.

Attack Vector

Exploitation is performed remotely over the network against any reachable HTTPS management interface on a vulnerable Junos OS device. An attacker iteratively issues HTTPS connection requests to the device. Each request consumes additional resources that are not released. After enough requests accumulate, the device becomes unresponsive and reboots, producing a denial-of-service condition that interrupts traffic flow on routers and switches and forwarding on firewalls.

No verified public exploit or proof-of-concept code is available for CVE-2024-47497. Refer to the Juniper Support Portal for vendor technical details.

Detection Methods for CVE-2024-47497

Indicators of Compromise

• Continuously growing count of mgd processes returned by show system processes extensive | match mgd | count over time.
• Unexpected memory and CPU pressure on the routing engine without corresponding configuration or traffic changes.
• Unscheduled device reboots correlated with bursts of inbound HTTPS connections to the management interface.

Detection Strategies

• Baseline normal httpd and mgd process counts on each device, then alert when counts deviate upward over hours or days.
• Monitor HTTPS connection rates to management interfaces and flag sources generating repeated, short-lived TLS handshakes.
• Correlate device reboot events in syslog with preceding spikes in management-plane resource utilization.

Monitoring Recommendations

• Forward Junos OS syslog and SNMP telemetry to a centralized SIEM and alert on RPD_SCHED_SLIP, memory pressure, and reboot messages.
• Use NetFlow or firewall logs to identify external sources connecting to TCP/443 on Junos management addresses.
• Schedule periodic execution of show system processes extensive and trend the output for early detection of process leaks.

How to Mitigate CVE-2024-47497

Immediate Actions Required

• Inventory all SRX, EX, MX, and QFX Series devices and identify those running affected Junos OS versions prior to 21.4R3-S7, 22.2R3-S4, 22.3R3-S3, 22.4R3-S2, 23.2R2-S1, 23.4R1-S2, or 23.4R2.
• Restrict HTTPS management access using firewall filters or system services web-management configuration so only trusted management networks can reach the daemon.
• Schedule maintenance windows to upgrade affected devices to fixed Junos OS releases per the Juniper advisory.

Patch Information

Juniper Networks has released fixed versions of Junos OS that resolve CVE-2024-47497. Upgrade SRX and EX Series devices to 21.4R3-S7, 22.2R3-S4, 22.3R3-S3, 22.4R3-S2, 23.2R2-S1, 23.4R1-S2, 23.4R2, or later. Patch details and download links are available through the Juniper Support Portal.

Workarounds

• Disable the J-Web HTTPS service on devices that do not require web-based management using delete system services web-management https.
• Apply loopback filters or management ACLs to permit HTTPS only from authorized administrative subnets.
• Periodically restart the httpd process during maintenance windows on unpatched devices to reclaim leaked resources until upgrades complete.

# Configuration example - restrict J-Web HTTPS to a trusted management prefix
set firewall family inet filter PROTECT-RE term ALLOW-MGMT from source-address 192.0.2.0/24
set firewall family inet filter PROTECT-RE term ALLOW-MGMT from protocol tcp
set firewall family inet filter PROTECT-RE term ALLOW-MGMT from destination-port 443
set firewall family inet filter PROTECT-RE term ALLOW-MGMT then accept
set firewall family inet filter PROTECT-RE term DENY-HTTPS from protocol tcp destination-port 443
set firewall family inet filter PROTECT-RE term DENY-HTTPS then discard
set interfaces lo0 unit 0 family inet filter input PROTECT-RE
commit