title: Junos OS: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filters
description:
An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions.
In an Abstracted Fabric (AF) scenario if routing-instances (RI) are configured, specific valid traffic destined to the device can bypass the configured lo0 firewall filters as it's received in the wrong RI context.
This issue affects Juniper Networks Junos OS on MX Series:
*  All versions earlier than 20.4R3-S9;
*  21.2 versions earlier than 21.2R3-S3;
*  21.4 versions earlier than 21.4R3-S5;
*  22.1 versions earlier than 22.1R3;
*  22.2 versions earlier than 22.2R3;
*  22.3 versions earlier than 22.3R2.
problem types: CWE-668 Exposure of Resource to Wrong Sphere
affected:
{
defaultStatus: unaffected
platforms: MX Series
product: Junos OS
vendor: Juniper Networks
versions:
lessThan: 20.4R3-S9, status: affected, version: 0, versionType: semver
lessThan: 21.2R3-S3, status: affected, version: 21.2, versionType: semver
lessThan: 21.4R3-S5, status: affected, version: 21.4, versionType: semver
lessThan: 22.1R3, status: affected, version: 22.1, versionType: semver
lessThan: 22.2R3, status: affected, version: 22.2, versionType: semver
lessThan: 22.3R2, status: affected, version: 22.3, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
exploits: Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
solutions: The following software releases have been updated to resolve this specific issue: Junos OS 20.4R3-S9, 21.2R3-S3, 21.4R3-S5, 22.1R3, 22.2R3, 22.3R2, 22.4R1, and all subsequent releases.
workarounds: There are no known workarounds for this issue.