CVE-2021-0262

Junos OS: QFX10002-60C: Use after free vulnerability found during static code analysis

MEDIUM
6.5
CVSS Score
Published: April 22, 2021 at 07:37 PM UTC
Updated: June 17, 2026 at 03:29 AM UTC
1 product affected across 1 vendorJunos

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.5
Exploit prediction
EPSS 0.4%

Description

Through routine static code analysis of the Juniper Networks Junos OS software codebase, the Secure Development Life Cycle team identified a Use After Free vulnerability in PFE packet processing on the QFX10002-60C switching platform. Exploitation of this vulnerability may allow a logically adjacent attacker to trigger a Denial of Service (DoS). Continued exploitation of this vulnerability will sustain the Denial of Service (DoS) condition. This issue only affects QFX10002-60C devices. No other product or platform is vulnerable to this issue. This issue affects Juniper Networks Junos OS on QFX10002-60C: 19.1 version 19.1R3-S1 and later versions; 19.1 versions prior to 19.1R3-S3; 19.2 version 19.2R2 and later versions; 19.2 versions prior to 19.2R3-S1; 20.2 versions prior to 20.2R1-S2. This issue does not affect Juniper Networks Junos OS: versions prior to 19.1R3; 19.2 versions prior to 19.2R2; any version of 19.3; version 20.2R2 and later releases.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Affected range stops below 19.1*, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 19.1R3 (unaffected)
Vendor states this is fixed in 19.2 (unaffected)
Vendor states this is fixed in 19.3 (unaffected)
Affected range stops below 20.2R1-S2, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 20.2R2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

x_refsource_MISCVendor Advisory
https://kb.juniper.net/JSA11153

CVSS

6.5MEDIUMjuniper
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card