CVE-2021-31351

Junos OS: MX Series: Receipt of specific packet on MS-MPC/MS-MIC causes line card reset

HIGH

7.5

CVSS Score

Published: October 19, 2021 at 06:16 PM UTC

Updated: June 17, 2026 at 03:51 AM UTC

18 products affected across 2 vendorsJunosMx960Mx480

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 1%

Description

An Improper Check for Unusual or Exceptional Conditions in packet processing on the MS-MPC/MS-MIC utilized by Juniper Networks Junos OS allows a malicious attacker to send a specific packet, triggering the MS-MPC/MS-MIC to reset, causing a Denial of Service (DoS). Continued receipt and processing of this packet will create a sustained Denial of Service (DoS) condition. This issue only affects specific versions of Juniper Networks Junos OS on MX Series: 17.3R3-S11; 17.4R2-S13; 17.4R3 prior to 17.4R3-S5; 18.1R3-S12; 18.2R2-S8, 18.2R3-S7, 18.2R3-S8; 18.3R3-S4; 18.4R3-S7; 19.1R3-S4, 19.1R3-S5; 19.2R1-S6; 19.3R3-S2; 19.4R2-S4, 19.4R2-S5; 19.4R3-S2; 20.1R2-S1; 20.2R2-S2, 20.2R2-S3, 20.2R3; 20.3R2, 20.3R2-S1; 20.4R1, 20.4R1-S1, 20.4R2; 21.1R1; This issue does not affect any version of Juniper Networks Junos OS prior to 15.1X49-D240;

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

17.4R2-S13 ≤ v < 17.4*18.2R2-S8, 18.2R3-S7 ≤ v < 18.2*18.4R1-S8, 18.4R2-S7 ≤ v < 18.4*19.4R2-S4 ≤ v < 19.4*20.2R2-S2 ≤ v < 20.2*20.3R1-S2 ≤ v < 20.3*20.4 ≤ v < 20.4R2-S1, 20.4R321.1 ≤ v < 21.1R1-S1, 21.1R217.3 r3-s11 17.3R3-S11 17.4 r2-s13 17.4 r3 17.4 r3-s1 17.4 r3-s2 17.4 r3-s3 17.4 r3-s4 17.4R2-S13 18.1 r3-s12 18.1R3-S12 18.2 r2-s8 18.2 r3-s7 18.2 r3-s8 18.2R2-S8 18.2R3-S7 18.3 r3-s4 18.3R3-S4 18.4 r3-s7 18.4R1-S8 18.4R2-S7 18.4R3-S7 19.1 r3-s4 19.1 r3-s5 19.1R3-S4 19.1R3-S5 19.2 r1-s6 19.2R1-S6 19.3 r3-s2 19.3R3-S2 19.4 r2-s4 19.4 r2-s5 19.4 r3-s2 19.4R2-S4 19.4R3-S2 20.1 r2-s1 20.1R2-S1 20.2 r2-s2 20.2 r2-s3 20.2 r3 20.2R2-S2 20.2R3 20.3 r2 20.3 r2-s1 20.3R1-S2 20.3R2 20.4 20.4 r1 20.4 r1-s1 20.4 r2 21.1 21.1 r1

Vendor states this is fixed in 15.1 (unaffected)

Vendor states this is fixed in 17.3 (unaffected)

Affected range stops below 17.4*, so it looks safe — our inference, not a vendor statement

Vendor states this is fixed in 17.4R3 (unaffected)

Affected range stops below 18.2*, so it looks safe — our inference, not a vendor statement

Affected range stops below 18.4*, so it looks safe — our inference, not a vendor statement

Affected range stops below 19.4*, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.2*, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.3*, so it looks safe — our inference, not a vendor statement

Affected range stops below 20.4R2-S1, 20.4R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.1R1-S1, 21.1R2, so it looks safe — our inference, not a vendor statement

juniper-mx10 (environment) · juniper-mx10000 (environment) · juniper-mx10003 (environment) · juniper-mx10008 (environment) · juniper-mx10016 (environment) · juniper-mx104 (environment) · juniper-mx150 (environment) · juniper-mx2008 (environment) · juniper-mx2010 (environment) · juniper-mx2020 (environment) · juniper-mx204 (environment) · juniper-mx240 (environment) · juniper-mx40 (environment) · juniper-mx480 (environment) · juniper-mx5 (environment) · juniper-mx80 (environment) · juniper-mx960 (environment)

Mx10 · Juniperdevice

80%

All versions

Mx10000 · Juniperdevice

80%

All versions

Mx10003 · Juniperdevice

80%

All versions

Mx10008 · Juniperdevice

80%

All versions