CVE-2023-44189
Junos OS Evolved: PTX10003 Series: MAC address validation bypass vulnerability
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series:
- All versions prior to 21.4R3-S4-EVO;
- 22.1 versions prior to 22.1R3-S3-EVO;
- 22.2 version 22.2R1-EVO and later versions;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R2-EVO.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Junos OS Evolved: PTX10003 Series: MAC address validation bypass vulnerability
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series:
- All versions prior to 21.4R3-S4-EVO;
- 22.1 versions prior to 22.1R3-S3-EVO;
- 22.2 version 22.2R1-EVO and later versions;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R2-EVO.
- Record
CVE-2023-44189- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2023-48548
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series:
- All versions prior to 21.4R3-S4-EVO;
- 22.1 versions prior to 22.1R3-S3-EVO;
- 22.2 version 22.2R1-EVO and later versions;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R2-EVO.
- Record
EUVD-2023-48548- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fwh4-pm54-qx88
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS...
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series:
- All versions prior to 21.4R3-S4-EVO;
- 22.1 versions prior to 22.1R3-S3-EVO;
- 22.2 version 22.2R1-EVO and later versions;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R2-EVO.
- Record
GHSA-fwh4-pm54-qx88- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10003 Series allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10003 Series:
- All versions prior to 21.4R3-S4-EVO;
- 22.1 versions prior to 22.1R3-S3-EVO;
- 22.2 version 22.2R1-EVO and later versions;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R2-EVO.
- Record
CVE-2023-44189- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-44189 is a medium vulnerability (CVSS 6.1) in Juniper Junos Os Evolved, published October 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. No source names a fixed version.