CVE-2020-1689

Junos OS: EX4300-MP/EX4600/QFX5K Series: High CPU load due to receipt of specific layer 2 frames when deployed in a Virtual Chassis configuration

MEDIUM

6.5

CVSS Score

Published: October 16, 2020 at 08:31 PM UTC

Updated: June 17, 2026 at 03:02 AM UTC

6 products affected across 2 vendorsJunosQfx5200Qfx5100

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploit prediction

EPSS 0.5%

Description

On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in a Virtual Chassis configuration, receipt of a stream of specific layer 2 frames can cause high CPU load, which could lead to traffic interruption. This issue does not occur when the device is deployed in Stand Alone configuration. The offending layer 2 frame packets can originate only from within the broadcast domain where the device is connected. This issue affects Juniper Networks Junos OS on EX4300-MP Series, EX4600 Series and QFX5K Series: 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R3-S2; 19.2 versions prior to 19.2R1-S5, 19.2R3; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S1, 19.4R3; 20.1 versions prior to 20.1R1-S3, 20.1R2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

17.3 ≤ v < 17.3R3-S917.4 ≤ v < 17.4R2-S11, 17.4R3-S2, 17.4R3-S318.1 ≤ v < 18.1R3-S1118.2 ≤ v < 18.2R3-S518.3 ≤ v < 18.3R2-S4, 18.3R3-S318.4 ≤ v < 18.4R2-S5, 18.4R3-S419.1 ≤ v < 19.1R3-S219.2 ≤ v < 19.2R1-S5, 19.2R319.3 ≤ v < 19.3R2-S4, 19.3R319.4 ≤ v < 19.4R1-S3, 19.4R2-S1, 19.4R320.1 ≤ v < 20.1R1-S3, 20.1R217.3 17.3 r1-s1 17.3 r2 17.3 r2-s1 17.3 r2-s2 17.3 r2-s3 17.3 r2-s4 17.3 r2-s5 17.3 r3 17.3 r3-s1 17.3 r3-s2 17.3 r3-s3 17.3 r3-s4 17.3 r3-s7 17.3 r3-s8 17.4 17.4 r1 17.4 r1-s1 17.4 r1-s2 17.4 r1-s4 17.4 r1-s5 17.4 r1-s6 17.4 r1-s7 17.4 r2 17.4 r2-s1 17.4 r2-s10 17.4 r2-s2 17.4 r2-s3 17.4 r2-s4 17.4 r2-s5 17.4 r2-s6 17.4 r2-s7 17.4 r2-s8 17.4 r2-s9 17.4 r3 17.4 r3-s1 17.4 r3-s2 18.1 18.1 r1 18.1 r2 18.1 r2-s1 18.1 r2-s2 18.1 r2-s4 18.1 r3 18.1 r3-s1 18.1 r3-s10 18.1 r3-s2 18.1 r3-s3 18.1 r3-s4 18.1 r3-s6 18.1 r3-s7 18.1 r3-s8 18.1 r3-s9 18.2 18.2 r1 18.2 r1-s3 18.2 r1-s4 18.2 r1-s5 18.2 r2 18.2 r2-s1 18.2 r2-s2 18.2 r2-s3 18.2 r2-s4 18.2 r2-s5 18.2 r2-s6 18.2 r3 18.2 r3-s1 18.2 r3-s2 18.2 r3-s3 18.2 r3-s4 18.3 18.3 r1 18.3 r1-s1 18.3 r1-s2 18.3 r1-s3 18.3 r1-s5 18.3 r1-s6 18.3 r2 18.3 r2-s1 18.3 r2-s2 18.3 r2-s3 18.3 r3 18.3 r3-s1 18.3 r3-s2 18.4 18.4 r1 18.4 r1-s1 18.4 r1-s2 18.4 r1-s5 18.4 r1-s6 18.4 r2 18.4 r2-s1 18.4 r2-s2 18.4 r2-s3 18.4 r2-s4 18.4 r3 18.4 r3-s1 18.4 r3-s2 18.4 r3-s3 19.1 19.1 r1 19.1 r1-s1 19.1 r1-s2 19.1 r1-s3 19.1 r1-s4 19.1 r2 19.1 r2-s1 19.1 r3 19.1 r3-s1 19.2 19.2 r1 19.2 r1-s1 19.2 r1-s2 19.2 r1-s3 19.2 r1-s4 19.3 19.3 r1 19.3 r1-s1 19.3 r2 19.3 r2-s1 19.3 r2-s2 19.3 r2-s3 19.4 19.4 r1 19.4 r1-s1 19.4 r1-s2 19.4 r2 20.1 20.1 r1 20.1 r1-s1 20.1 r1-s2

Affected range stops below 17.3R3-S9, so it looks safe — our inference, not a vendor statement

Affected range stops below 17.4R2-S11, 17.4R3-S2, 17.4R3-S3, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.1R3-S11, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.2R3-S5, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.3R2-S4, 18.3R3-S3, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.4R2-S5, 18.4R3-S4, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.1R3-S2, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.2R1-S5, 19.2R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.3R2-S4, 19.3R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.4R1-S3, 19.4R2-S1, 19.4R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.1R1-S3, 20.1R2, so it looks safe — our inference, not a vendor statement

juniper-ex4300-mp (environment) · juniper-qfx5100 (environment) · juniper-qfx5120 (environment) · juniper-qfx5130 (environment) · juniper-qfx5200 (environment)

Ex4300-Mp · Juniperdevice

80%

All versions

Qfx5100 · Juniperdevice

80%

All versions

Qfx5120 · Juniperdevice

80%

All versions

Qfx5130 · Juniperdevice

80%

All versions