CVE-2024-47489
Junos OS Evolved: ACX Series: Receipt of specific transit protocol packets is incorrectly processed by the RE
An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices.
Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices.
This issue affects both IPv4 and IPv6. This issue does not require any specific routing protocol to be configured or enabled.
The following commands can be used to monitor the DDoS protection queue:
labuser@re0> show evo-pfemand host pkt-stats
labuser@re0> show host-path ddos all-policers
This issue affects Junos OS Evolved:
- All versions before 21.4R3-S8-EVO,
- from 22.2 before 22.2R3-S4-EVO,
- from 22.3 before 22.3R3-S4-EVO,
- from 22.4 before 22.4R3-S3-EVO,
- from 23.2 before 23.2R2-EVO,
- from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO,
- from 24.2 before 24.2R2-EVO.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Junos OS Evolved: ACX Series: Receipt of specific transit protocol packets is incorrectly processed by the RE
An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices.
Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices.
This issue affects both IPv4 and IPv6. This issue does not require any specific routing protocol to be configured or enabled.
The following commands can be used to monitor the DDoS protection queue:
labuser@re0> show evo-pfemand host pkt-stats
labuser@re0> show host-path ddos all-policers
This issue affects Junos OS Evolved:
- All versions before 21.4R3-S8-EVO,
- from 22.2 before 22.2R3-S4-EVO,
- from 22.3 before 22.3R3-S4-EVO,
- from 22.4 before 22.4R3-S3-EVO,
- from 23.2 before 23.2R2-EVO,
- from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO,
- from 24.2 before 24.2R2-EVO.
- Record
CVE-2024-47489- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L/R:A - CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-755
- Updated
- 2026-11-02
EUVDEUVD-2024-42494
An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices.
Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices.
This issue affects both IPv4 and IPv6. This issue does not require any specific routing protocol to be configured or enabled.
The following commands can be used to monitor the DDoS protection queue:
labuser@re0> show evo-pfemand host pkt-stats
labuser@re0> show host-path ddos all-policers
This issue affects Junos OS Evolved:
- All versions before 21.4R3-S8-EVO,
- from 22.2 before 22.2R3-S4-EVO,
- from 22.3 before 22.3R3-S4-EVO,
- from 22.4 before 22.4R3-S3-EVO,
- from 23.2 before 23.2R2-EVO,
- from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO,
- from 24.2 before 24.2R2-EVO.
- Record
EUVD-2024-42494- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L/R:A - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3x4w-v43m-f5m7
An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe...
An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices.
Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices.
This issue affects both IPv4 and IPv6. This issue does not require any specific routing protocol to be configured or enabled.
The following commands can be used to monitor the DDoS protection queue:
labuser@re0> show evo-pfemand host pkt-stats
labuser@re0> show host-path ddos all-policers
This issue affects Junos OS Evolved:
- All versions before 21.4R3-S8-EVO,
- from 22.2 before 22.2R3-S4-EVO,
- from 22.3 before 22.3R3-S4-EVO,
- from 22.4 before 22.4R3-S3-EVO,
- from 23.2 before 23.2R2-EVO,
- from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO,
- from 24.2 before 24.2R2-EVO.
- Record
GHSA-3x4w-v43m-f5m7- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X - CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-755
- Updated
- 2026-11-02
NVD
An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved on ACX Series devices allows an unauthenticated, network based attacker sending specific transit protocol traffic to cause a partial Denial of Service (DoS) to downstream devices.
Receipt of specific transit protocol packets is incorrectly processed by the Routing Engine (RE), filling up the DDoS protection queue which is shared between routing protocols. This influx of transit protocol packets causes DDoS protection violations, resulting in protocol flaps which can affect connectivity to networking devices.
This issue affects both IPv4 and IPv6. This issue does not require any specific routing protocol to be configured or enabled.
The following commands can be used to monitor the DDoS protection queue:
labuser@re0> show evo-pfemand host pkt-stats
labuser@re0> show host-path ddos all-policers
This issue affects Junos OS Evolved:
- All versions before 21.4R3-S8-EVO,
- from 22.2 before 22.2R3-S4-EVO,
- from 22.3 before 22.3R3-S4-EVO,
- from 22.4 before 22.4R3-S3-EVO,
- from 23.2 before 23.2R2-EVO,
- from 23.4 before 23.4R1-S1-EVO, 23.4R2-EVO,
- from 24.2 before 24.2R2-EVO.
- Record
CVE-2024-47489- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:A/V:X/RE:X/U:X - CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-755
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47489 is a medium vulnerability (CVSS 6.9) in Juniper Junos Os Evolved, published October 11, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. No source names a fixed version.