CVE-2020-1650

Junos OS: MX Series: Denial of Service vulnerability in MS-PIC component on MS-MIC or MS-MPC

HIGH

7.5

CVSS Score

Published: July 17, 2020 at 06:40 PM UTC

Updated: June 17, 2026 at 03:02 AM UTC

16 products affected across 2 vendorsJunosMx480Mx960

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 1%

Description

On Juniper Networks Junos MX Series with service card configured, receipt of a stream of specific packets may crash the MS-PIC component on MS-MIC or MS-MPC. By continuously sending these specific packets, an attacker can repeatedly bring down MS-PIC on MS-MIC/MS-MPC causing a prolonged Denial of Service. This issue affects MX Series devices using MS-PIC, MS-MIC or MS-MPC service cards with any service configured. This issue affects Juniper Networks Junos OS on MX Series: 17.2R2-S7; 17.3R3-S4, 17.3R3-S5; 17.4R2-S4 and the subsequent SRs (17.4R2-S5, 17.4R2-S6, etc.); 17.4R3; 18.1R3-S3, 18.1R3-S4, 18.1R3-S5, 18.1R3-S6, 18.1R3-S7, 18.1R3-S8; 18.2R3, 18.2R3-S1, 18.2R3-S2; 18.3R2 and the SRs based on 18.3R2; 18.4R2 and the SRs based on 18.4R2; 19.1R1 and the SRs based on 19.1R1; 19.2R1 and the SRs based on 19.2R1; 19.3R1 and the SRs based on 19.3R1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

17.4R2-S4 ≤ v < 17.4*18.3R2 ≤ v < 18.3*18.4R2 ≤ v < 18.4*19.1R1 ≤ v < 19.1*19.2R1 ≤ v < 19.2*19.3R1 ≤ v < 19.3*17.2 r2-s7 17.2R2-S7 17.3R3-S4 17.3R3-S5 17.4 r2-s4 17.4 r2-s5 17.4 r2-s6 17.4 r2-s7 17.4 r2-s8 17.4 r2-s9 17.4 r3 17.4R2-S4 17.4R3 18.1 r1 18.1 r2 18.1 r3-s3 18.1 r3-s4 18.1 r3-s5 18.1 r3-s6 18.1 r3-s7 18.1 r3-s8 18.1R3-S3 18.1R3-S4 18.1R3-S5 18.1R3-S6 18.1R3-S7 18.1R3-S8 18.2 r1 18.2 r1-s3 18.2 r1-s4 18.2 r2 18.2 r3 18.2 r3-s1 18.2 r3-s2 18.2R3 18.2R3-S1 18.2R3-S2 18.3 r2 18.3 r2-s1 18.3 r2-s2 18.3 r2-s3 18.3R2 18.4 r2 18.4 r2-s1 18.4 r2-s2 18.4 r2-s3 18.4R2 19.1 r1 19.1 r1-s1 19.1 r1-s2 19.1 r1-s3 19.1R1 19.2 r1 19.2 r1-s1 19.2 r1-s2 19.2R1 19.3 r1 19.3 r1-s1 19.3R1

Affected range stops below 17.4*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.3*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.4*, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.1*, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2*, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.3*, so it looks safe — our inference, not a vendor statement

juniper-mx10 (environment) · juniper-mx10000 (environment) · juniper-mx10003 (environment) · juniper-mx104 (environment) · juniper-mx150 (environment) · juniper-mx2008 (environment) · juniper-mx2010 (environment) · juniper-mx2020 (environment) · juniper-mx204 (environment) · juniper-mx240 (environment) · juniper-mx40 (environment) · juniper-mx480 (environment) · juniper-mx5 (environment) · juniper-mx80 (environment) · juniper-mx960 (environment)

Mx10 · Juniperdevice

80%

All versions

Mx10000 · Juniperdevice

80%

All versions

Mx10003 · Juniperdevice

80%

All versions

Mx104 · Juniperdevice

80%

All versions