Junos OS (SRX firewalls)
CVE-2024-21603: MX Series: Gathering statistics in a scaled SCU/DCU configuration will lead to a device crash
An Improper Check for Unusual or Exceptional Conditions vulnerability in the kernel of Juniper Network Junos OS on MX Series allows a network based attacker with low privileges to cause a denial of service.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series) 0 | 20.4R3-S9 or later |
| Junos OS (MX Series) 21.2 | 21.2R3-S6 or later |
| Junos OS (MX Series) 21.3 | 21.3R3-S5 or later |
| Junos OS (MX Series) 21.4 | 21.4R3 or later |
| Junos OS (MX Series) 22.1 | 22.1R3 or later |
| Junos OS (MX Series) 22.2 | 22.2R2 or later |
| Junos OS (MX Series) 22.3 | 22.3R2 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Improper Check for Unusual or Exceptional Conditions vulnerability in the kernel of Juniper Network Junos OS on MX Series allows a network based attacker with low privileges to cause a denial of service.
If a scaled configuration for Source class usage (SCU) / destination class usage (DCU) (more than 10 route classes) is present and the SCU/DCU statistics are gathered by executing specific SNMP requests or CLI commands, a 'vmcore' for the RE kernel will be seen which leads to a device restart. Continued exploitation of this issue will lead to a sustained DoS.
This issue only affects MX Series devices with MPC10, MPC11 or LC9600, and MX304. No other MX Series devices are affected.
This issue affects Juniper Networks Junos OS:
- All versions earlier than 20.4R3-S9;
- 21.2 versions earlier than 21.2R3-S6;
- 21.3 versions earlier than 21.3R3-S5;
- 21.4 versions earlier than 21.4R3;
- 22.1 versions earlier than 22.1R3;
- 22.2 versions earlier than 22.2R2;
- 22.3 versions earlier than 22.3R2.
Am I affected?
To be exposed to this issue a scaled SCU/DCU configuration with more than 10 classes needs to be present on the device:
[ policy-options policy-statement <policy name> term <term name> then source-class/destination-class <scu/dcu-class name1> ] ... [ policy-options policy-statement <policy name> term <term name> then source-class/destination-class <scu/dcu-class name11> ] [ interface <interface> unit <unit#> family <family> accounting source-class-usage/destination-class-usage input/output ]
Workarounds
There are no known workarounds for this issue.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.