// For flags

CVE-2020-1633

Junos OS: MX Series: Crafted packets traversing a Broadband Network Gateway (BNG) configured with IPv6 NDP proxy could lead to Denial of Service

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

< 1%
*EPSS

Affected Versions

1125
*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Due to a new NDP proxy feature for EVPN leaf nodes introduced in Junos OS 17.4, crafted NDPv6 packets could transit a Junos device configured as a Broadband Network Gateway (BNG) and reach the EVPN leaf node, causing a stale MAC address entry. This could cause legitimate traffic to be discarded, leading to a Denial of Service (DoS) condition. This issue only affects Junos OS 17.4 and later releases. Prior releases do not support this feature and are unaffected by this vulnerability. This issue only affects IPv6. IPv4 ARP proxy is unaffected by this vulnerability. This issue affects Juniper Networks Junos OS: 17.4 versions prior to 17.4R2-S9, 17.4R3 on MX Series; 18.1 versions prior to 18.1R3-S9 on MX Series; 18.2 versions prior to 18.2R2-S7, 18.2R3-S3 on MX Series; 18.2X75 versions prior to 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D60 on MX Series; 18.3 versions prior to 18.3R1-S7, 18.3R2-S3, 18.3R3 on MX Series; 18.4 versions prior to 18.4R1-S5, 18.4R2-S2, 18.4R3 on MX Series; 19.1 versions prior to 19.1R1-S4, 19.1R2 on MX Series; 19.2 versions prior to 19.2R1-S3, 19.2R2 on MX Series.

Debido a una nueva funcionalidad de proxy NDP para los nodos leaf de EVPN introducidos en Junos OS versión 17.4, los paquetes NDPv6 diseñados podrían transitar un dispositivo Junos configurado como una Broadband Network Gateway (BNG) y llegar al nodo leaf de EVPN, causando una entrada de dirección MAC obsoleta. Esto podría causar que sea descartado el tráfico legítimo, lo que conllevaría a una condición de Denegación de Servicio (DoS). Este problema solo afecta a Junos OS versiones 17.4 y posteriores. Las versiones anteriores no admiten esta funcionalidad y no están afectadas por esta vulnerabilidad. Este problema solo afecta a IPv6. El proxy ARP de IPv4 no está afectado por esta vulnerabilidad. Este problema afecta a Juniper Networks Junos OS: versiones 17.4 anteriores a 17.4R2-S9, 17.4R3 en MX Series; versiones 18.1 anteriores a 18.1R3-S9 en MX Series; versiones 18.2 anteriores a 18.2R2-S7, 18.2R3-S3 en MX Series; versiones 18.2X75 anteriores a 18.2X75-D33, 18.2X75-D411, 18.2X75-D420, 18.2X75-D60 en MX Series; versiones 18.3 anteriores a 18.3R1-S7, 18.3R2-S3, 18.3R3 en MX Series; versiones 18.4 anteriores a 18.4R1-S5, 18.4R2-S2, 18.4R3 en MX Series; versiones 19.1 anteriores a 19.1R1-S4, 19.1R2 en MX Series; versiones 19.2 anteriores a 19.2R1-S3, 19.2R2 en MX Series.

*Credits: N/A
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Adjacent
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-11-04 CVE Reserved
  • 2020-04-09 CVE Published
  • 2024-09-17 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
References (1)
URL Tag Source
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions (1125)