CVE-2024-30401

Junos OS: MX Series and EX9200-15C: Stack-based buffer overflow in aftman

MEDIUM

5.9

CVSS Score

Published: April 12, 2024 at 03:26 PM UTC

Updated: June 17, 2026 at 07:26 AM UTC

1 product affected across 1 vendorJunos

Using Junos OS by Juniper Networks?

Get instant alerts when new vulnerabilities affect Junos OS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.9

Exploit prediction

EPSS 0.6%

SSVC

No known exploit

Description

An Out-of-bounds Read vulnerability in the advanced forwarding management process aftman of Juniper Networks Junos OS on MX Series with MPC10E, MPC11, MX10K-LC9600 line cards, MX304, and EX9200-15C, may allow an attacker to exploit a stack-based buffer overflow, leading to a reboot of the FPC. Through code review, it was determined that the interface definition code for aftman could read beyond a buffer boundary, leading to a stack-based buffer overflow. This issue affects Junos OS on MX Series and EX9200-15C: * from 21.2 before 21.2R3-S1, * from 21.4 before 21.4R3, * from 22.1 before 22.1R2, * from 22.2 before 22.2R2; This issue does not affect: * versions of Junos OS prior to 20.3R1; * any version of Junos OS 20.4.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Junos · Juniper Networks

95%

21.2 ≤ v < 21.2R3-S121.4 ≤ v < 21.4R322.1 ≤ v < 22.1R222.2 ≤ v < 22.2R221.2 21.2 r1 21.2 r1-s1 21.2 r1-s2 21.2 r2 21.2 r2-s1 21.2 r2-s2 21.2 r3 21.4 21.4 r1 21.4 r1-s1 21.4 r1-s2 21.4 r2 21.4 r2-s1 21.4 r2-s2 22.1 22.1 r1 22.1 r1-s1 22.1 r1-s2 22.2 22.2 r1 22.2 r1-s1 22.2 r1-s2

Vendor states this is fixed in 20.3R1 (unaffected)

Vendor states this is fixed in 20.4 (unaffected)

Affected range stops below 21.2R3-S1, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.4R3, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.1R2, so it looks safe — our inference, not a vendor statement

Affected range stops below 22.2R2, so it looks safe — our inference, not a vendor statement

juniper-ex9200-15c (environment) · juniper-lc9600 (environment) · juniper-mpc10e-10c (environment) · juniper-mpc10e-15c (environment) · juniper-mpc11 (environment) · juniper-mx10004 (environment) · juniper-mx10008 (environment) · juniper-mx2008 (environment) · juniper-mx2010 (environment) · juniper-mx2020 (environment) · juniper-mx204 (environment) · juniper-mx240 (environment) · juniper-mx304 (environment) · juniper-mx480 (environment) · juniper-mx960 (environment)