CVE-2023-28981

MEDIUM

Juniper Networks Junos OS <20.3R3-S5, <20.4R3-S3, <21.1 - DoS

Title source: llm
STIX 2.1

Description

An Improper Input Validation vulnerability in the kernel of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to cause a Denial of Service (DoS). If the receipt of router advertisements is enabled on an interface and a specifically malformed RA packet is received, memory corruption will happen which leads to an rpd crash. This issue affects: Juniper Networks Junos OS 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S3; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2. Juniper Networks Junos OS Evolved 20.3-EVO version 20.3R1-EVO and later versions; 20.4-EVO versions prior to 20.4R3-S6-EVO; 21.3-EVO versions prior to 21.3R3-EVO; 21.4-EVO versions prior to 21.4R2-EVO; 22.1-EVO versions prior to 22.1R2-EVO.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0011
EPSS Percentile 28.4%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-20
Status published
Products (7)
juniper/junos 20.3 (11 CPE variants)
juniper/junos 20.4 (9 CPE variants)
juniper/junos 21.1 (10 CPE variants)
juniper/junos 21.2 (7 CPE variants)
juniper/junos 21.3 (7 CPE variants)
juniper/junos 21.4 (4 CPE variants)
juniper/junos 22.1 r1 (2 CPE variants)
Published Apr 17, 2023
Tracked Since Feb 18, 2026