CVE-2019-0048

EX4300 Series: When a firewall filter is applied to a loopback interface, other firewall filters for multicast traffic may fail

MEDIUM

5.8

CVSS Score

Published: July 11, 2019 at 07:40 PM UTC

Updated: June 17, 2026 at 02:07 AM UTC

20 products affected across 2 vendorsJunosEx4300-24T-SEx4300-32F

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.8

Exploit prediction

EPSS 1.0%

Description

On EX4300 Series switches with TCAM optimization enabled, incoming multicast traffic matches an implicit loopback filter rule first, since it has high priority. This rule is meant for reserved multicast addresses 224.0.0.x, but incorrectly matches on 224.x.x.x. Due to this bug, when a firewall filter is applied on the loopback interface, other firewall filters might stop working for multicast traffic. The command 'show firewall filter' can be used to confirm whether the filter is working. This issue only affects the EX4300 switch. No other products or platforms are affected by this vulnerability. This issue affects: Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D51, 14.1X53-D115 on EX4300 Series; 17.1 versions prior to 17.1R3 on EX4300 Series; 17.2 versions prior to 17.2R3-S2 on EX4300 Series; 17.3 versions prior to 17.3R3-S3 on EX4300 Series; 17.4 versions prior to 17.4R2-S5, 17.4R3 on EX4300 Series; 18.1 versions prior to 18.1R3-S1 on EX4300 Series; 18.2 versions prior to 18.2R2 on EX4300 Series; 18.3 versions prior to 18.3R2 on EX4300 Series.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

v < 14.1X53-D51v < 17.1R3v < 17.2R3-S2v < 17.3R3-S3v < 17.4R2-S5v < 18.1R3-S1v < 18.2R2v < 18.3R214.1x5314.1x53 d10 14.1x53 d15 14.1x53 d16 14.1x53 d25 14.1x53 d26 14.1x53 d27 14.1x53 d30 14.1x53 d35 14.1x53 d40 14.1x53 d45 14.1x53 d48 14.1x53 d49 17.1 17.1 r1 17.1 r2-s1 17.1 r2-s10 17.1 r2-s2 17.1 r2-s3 17.1 r2-s4 17.1 r2-s5 17.1 r2-s6 17.1 r2-s7 17.2 17.2 r1 17.2 r1-s2 17.2 r1-s4 17.2 r1-s7 17.2 r2 17.2 r2-s6 17.2 r2-s7 17.2 r3-s1 17.3 17.3 r1 17.3 r2 17.3 r2-s1 17.3 r2-s2 17.3 r3-s1 17.3 r3-s2 17.4 17.4 r1 17.4 r1-s1 17.4 r1-s2 17.4 r1-s4 17.4 r2 17.4 r2-s1 17.4 r2-s2 17.4 r2-s3 17.4 r2-s4 18.1 18.1 r1 18.1 r2 18.1 r2-s1 18.1 r2-s2 18.2 18.2 r1 18.2 r1-s3 18.2 r1-s4 18.2 r2-s1 18.2 r2-s2 18.2 r2-s3 18.2 r2-s4 18.3 18.3 r1 18.3 r1-s1 18.3 r1-s2 18.3 r1-s3 18.3 r1-s4

Affected range stops below 14.1X53-D51, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.1R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.2R3-S2, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.3R3-S3, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.4R2-S5, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.1R3-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.2R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.3R2, so it looks safe — our inference, not a vendor statement

juniper-ex4300-24p (environment) · juniper-ex4300-24p-s (environment) · juniper-ex4300-24t (environment) · juniper-ex4300-24t-s (environment) · juniper-ex4300-32f (environment) · juniper-ex4300-32f-dc (environment) · juniper-ex4300-32f-s (environment) · juniper-ex4300-48mp (environment) · juniper-ex4300-48mp-s (environment) · juniper-ex4300-48p (environment) · juniper-ex4300-48p-s (environment) · juniper-ex4300-48t (environment) · juniper-ex4300-48t-afi (environment) · juniper-ex4300-48t-dc (environment) · juniper-ex4300-48t-dc-afi (environment) · juniper-ex4300-48t-s (environment) · juniper-ex4300-48tafi (environment) · juniper-ex4300-48tdc (environment) · juniper-ex4300-48tdc-afi (environment)

Ex4300-24P · Juniperdevice

80%

All versions

Ex4300-24P-S · Juniperdevice

80%

All versions

Ex4300-24T · Juniperdevice

80%

All versions

Ex4300-24T-S · Juniperdevice

80%

All versions