title: Junos OS: ACX2K Series: Receipt of a high rate of specific traffic will lead to a Denial of Service (DoS)
description: A vulnerability in class-of-service (CoS) queue management in Juniper Networks Junos OS on the ACX2K Series devices allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). Specific packets are being incorrectly routed to a queue used for other high-priority traffic such as BGP, PIM, ICMP, ICMPV6 ND and ISAKMP. Due to this misclassification of traffic, receipt of a high rate of these specific packets will cause delays in the processing of other traffic, leading to a Denial of Service (DoS). Continued receipt of this amount of traffic will create a sustained Denial of Service (DoS) condition. This issue affects Juniper Networks Junos OS on ACX2K Series: All versions prior to 19.4R3-S9; All 20.2 versions; 20.3 versions prior to 20.3R3-S6 on ACX2K Series; 20.4 versions prior to 20.4R3-S4 on ACX2K Series; All 21.1 versions; 21.2 versions prior to 21.2R3-S3 on ACX2K Series. Note: This issues affects legacy ACX2K Series PPC-based devices. This platform reached Last Supported Version (LSV) as of the Junos OS 21.2 Release.
problem types: CWE-755 Improper Handling of Exceptional Conditions
affected:
{
vendor: Juniper Networks
product: Junos OS
versions:
version: unspecified, lessThan: 19.4R3-S9, status: affected, versionType: custom
version: 20.2R1, status: affected, lessThan: 20.2*, versionType: custom
version: 20.3, status: affected, lessThan: 20.3R3-S6, versionType: custom
version: 20.4, status: affected, lessThan: 20.4R3-S4, versionType: custom
version: 21.1R1, status: affected, lessThan: 21.1*, versionType: custom
version: 21.2, status: affected, lessThan: 21.2R3-S3, versionType: custom
platforms: ACX2K Series
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
]
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: Junos OS 19.4R3-S9, 20.3R3-S6, 20.4R3-S4, and 21.2R3-S3.
Note: Legacy ACX2000 Series PPC-based devices have reached Last Supported Version (LSV) as of Junos OS 21.2.
workarounds: There are no known workarounds for this issue.