CVE-2023-44190
Junos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerability
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016:
- All versions prior to 21.4R3-S5-EVO;
- 22.1 versions prior to 22.1R3-S4-EVO;
- 22.2 versions 22.2R1-EVO and later;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Junos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerability
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016:
- All versions prior to 21.4R3-S5-EVO;
- 22.1 versions prior to 22.1R3-S4-EVO;
- 22.2 versions 22.2R1-EVO and later;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.
- Record
CVE-2023-44190- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2023-48549
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016:
- All versions prior to 21.4R3-S5-EVO;
- 22.1 versions prior to 22.1R3-S4-EVO;
- 22.2 versions 22.2R1-EVO and later;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.
- Record
EUVD-2023-48549- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2xg8-857g-4j2x
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS...
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016:
- All versions prior to 21.4R3-S5-EVO;
- 22.1 versions prior to 22.1R3-S4-EVO;
- 22.2 versions 22.2R1-EVO and later;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.
- Record
GHSA-2xg8-857g-4j2x- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
An Origin Validation vulnerability in MAC address validation of Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016 devices allows a network-adjacent attacker to bypass MAC address checking, allowing MAC addresses not intended to reach the adjacent LAN to be forwarded to the downstream network. Due to this issue, the router will start forwarding traffic if a valid route is present in forwarding-table, causing a loop and congestion in the downstream layer-2 domain connected to the device.
This issue affects Juniper Networks Junos OS Evolved on PTX10001, PTX10004, PTX10008, and PTX10016:
- All versions prior to 21.4R3-S5-EVO;
- 22.1 versions prior to 22.1R3-S4-EVO;
- 22.2 versions 22.2R1-EVO and later;
- 22.3 versions prior to 22.3R2-S2-EVO, 22.3R3-S1-EVO;
- 22.4 versions prior to 22.4R2-S1-EVO, 22.4R3-EVO;
- 23.2 versions prior to 23.2R1-S1-EVO, 23.2R2-EVO.
- Record
CVE-2023-44190- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L - Weakness
- CWE-346
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-44190 is a medium vulnerability (CVSS 6.1) in Juniper Junos Os Evolved, published October 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. No source names a fixed version.