CVE-2020-1651

Junos OS: MX Series: PFE on the line card may crash due to memory leak.

MEDIUM

6.5

CVSS Score

Published: July 17, 2020 at 06:40 PM UTC

Updated: June 17, 2026 at 03:02 AM UTC

16 products affected across 2 vendorsJunosMx480Mx960

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.5%

Description

On Juniper Networks MX series, receipt of a stream of specific Layer 2 frames may cause a memory leak resulting in the packet forwarding engine (PFE) on the line card to crash and restart, causing traffic interruption. By continuously sending this stream of specific layer 2 frame, an attacker connected to the same broadcast domain can repeatedly crash the PFE, causing a prolonged Denial of Service (DoS). This issue affects Juniper Networks Junos OS on MX Series: 17.2 versions prior to 17.2R3-S4; 17.2X75 versions prior to 17.2X75-D105.19; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R1-S3, 17.4R2; 18.1 versions prior to 18.1R2. This issue does not affect Juniper Networks Junos OS releases prior to 17.2R1.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

17.2 ≤ v < 17.2R3-S417.2X75 ≤ v < 17.2X75-D105.1917.3 ≤ v < 17.3R3-S717.4 ≤ v < 17.4R1-S3, 17.4R218.1 ≤ v < 18.1R217.2 17.2 r1 17.2 r1-s1 17.2 r1-s2 17.2 r1-s3 17.2 r1-s4 17.2 r1-s5 17.2 r1-s7 17.2 r1-s8 17.2 r2 17.2 r2-s11 17.2 r2-s6 17.2 r2-s7 17.2 r3-s1 17.2 r3-s2 17.2 r3-s3 17.2X7517.2x7517.2x75 d102 17.2x75 d50 17.2x75 d70 17.2x75 d92 17.3 17.3 r1-s1 17.3 r2 17.3 r2-s1 17.3 r2-s2 17.3 r2-s3 17.3 r2-s4 17.3 r3 17.3 r3-s1 17.3 r3-s2 17.3 r3-s3 17.3 r3-s4 17.4 17.4 r1 17.4 r1-s1 17.4 r1-s2 18.1 18.1 r1

Vendor states this is fixed in 17.2R1 (unaffected)

Affected range stops below 17.2R3-S4, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.2X75-D105.19, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.3R3-S7, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.4R1-S3, 17.4R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.1R2, so it looks safe — our inference, not a vendor statement

juniper-mx10 (environment) · juniper-mx10000 (environment) · juniper-mx10003 (environment) · juniper-mx104 (environment) · juniper-mx150 (environment) · juniper-mx2008 (environment) · juniper-mx2010 (environment) · juniper-mx2020 (environment) · juniper-mx204 (environment) · juniper-mx240 (environment) · juniper-mx40 (environment) · juniper-mx480 (environment) · juniper-mx5 (environment) · juniper-mx80 (environment) · juniper-mx960 (environment)

Mx10 · Juniperdevice

80%

All versions

Mx10000 · Juniperdevice

80%

All versions

Mx10003 · Juniperdevice

80%

All versions

Mx104 · Juniperdevice

80%

All versions