Juniper Junos OS Evolved Local Address Validation API Error Comparison Vulnerability (CVE-2024-39534)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: CVE-2024-39534 2. Affected Product: Junos OS Evolved 3. Issue Description: An unauthorized network-adjacent attacker can exploit a flawed comparison vulnerability in the local address validation API to create sessions or send traffic to the device using subnets of network and broadcast addresses. 4. Affected Versions: - All versions prior to 21.4R3-S8-EVO - 22.2-EVO prior to 22.2R3-S4-EVO - 22.3-EVO prior to 22.3R3-S4-EVO - 22.4-EVO prior to 22.4R3-S3-EVO - 23.2-EVO prior to 23.2R2-S1-EVO - 23.4-EVO prior to 23.4R1-S2-EVO, 23.4R2-EVO 5. Severity: Medium (CVSS v3.1: 5.4, CVSS v4.0: 5.3) 6. Solution: Updated software versions include 21.4R3-S8-EVO, 22.2R3-S4-EVO, 22.3R3-S4-EVO, 22.4R3-S3-EVO, 23.2R2-S1-EVO, 23.4R1-S2-EVO, 23.4R2-EVO, and 24.2R1-EVO and later versions. 7. Workaround: Use access lists or firewall filters to restrict access to the device, allowing access only from trusted hosts. 8. Related Links: - KB16613: Juniper Networks SIRT Quarterly Security Bulletin Release Process Overview - KB16765: Which Versions Fixed the Vulnerability? - KB16446: CVSS and Juniper Security Bulletins – Common Vulnerability Scoring System (CVSS) and Juniper’s Usage - Report a Security Vulnerability – How to Contact Juniper Networks Security Incident Response Team This information helps understand the nature, scope of impact, and how to mitigate or work around the vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Juniper Junos OS Evolved Local Address Validation API Error Comparison Vulnerability (CVE-2024-39534)