Junos OS (SRX firewalls)
CVE-2024-21591: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code Execution
An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (SRX Series, EX Series) 0 | 20.4R3-S9 or later |
| Junos OS (SRX Series, EX Series) 21.2 | 21.2R3-S7 or later |
| Junos OS (SRX Series, EX Series) 21.3 | 21.3R3-S5 or later |
| Junos OS (SRX Series, EX Series) 21.4 | 21.4R3-S5 or later |
| Junos OS (SRX Series, EX Series) 22.1 | 22.1R3-S4 or later |
| Junos OS (SRX Series, EX Series) 22.2 | 22.2R3-S3 or later |
| Junos OS (SRX Series, EX Series) 22.3 | 22.3R3-S2 or later |
| Junos OS (SRX Series, EX Series) 22.4 | 22.4R2-S2, 22.4R3 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device.
This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory.
This issue affects Juniper Networks Junos OS SRX Series and EX Series:
- Junos OS versions earlier than 20.4R3-S9;
- Junos OS 21.2 versions earlier than 21.2R3-S7;
- Junos OS 21.3 versions earlier than 21.3R3-S5;
- Junos OS 21.4 versions earlier than 21.4R3-S5;
- Junos OS 22.1 versions earlier than 22.1R3-S4;
- Junos OS 22.2 versions earlier than 22.2R3-S3;
- Junos OS 22.3 versions earlier than 22.3R3-S2;
- Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.
Am I affected?
The following minimal configuration must be present on the device:
[system services web-management http]or
[system services web-management https]
Workarounds
Disable J-Web, or limit access to only trusted hosts.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.