Junos OS (SRX firewalls)
CVE-2024-21597: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filters
An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 20.4R3-S9 or later |
| Junos OS (MX Series) 21.2 | 21.2R3-S3 or later |
| Junos OS (MX Series) 21.4 | 21.4R3-S5 or later |
| Junos OS (MX Series) 22.1 | 22.1R3 or later |
| Junos OS (MX Series) 22.2 | 22.2R3 or later |
| Junos OS (MX Series) 22.3 | 22.3R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions.
In an Abstracted Fabric (AF) scenario if routing-instances (RI) are configured, specific valid traffic destined to the device can bypass the configured lo0 firewall filters as it's received in the wrong RI context.
This issue affects Juniper Networks Junos OS on MX Series:
- All versions earlier than 20.4R3-S9;
- 21.2 versions earlier than 21.2R3-S3;
- 21.4 versions earlier than 21.4R3-S5;
- 22.1 versions earlier than 22.1R3;
- 22.2 versions earlier than 22.2R3;
- 22.3 versions earlier than 22.3R2.
Am I affected?
To be exposed to this issue node-slicing must be configured:
[ chassis network-slices guest-network-functions ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.