Junos OS (SRX firewalls)
CVE-2024-21607: MX Series and EX9200 Series: If the "tcp-reset" option used in an IPv6 filter, matched packets are accepted instead of rejected
An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to cause partial impact to the integrity of the device.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (MX Series, EX9200 Series) 0 | 20.4R3-S7 or later |
| Junos OS (MX Series, EX9200 Series) 21.1 | 21.1R3-S5 or later |
| Junos OS (MX Series, EX9200 Series) 21.2 | 21.2R3-S5 or later |
| Junos OS (MX Series, EX9200 Series) 21.3 | 21.3R3-S4 or later |
| Junos OS (MX Series, EX9200 Series) 21.4 | 21.4R3-S4 or later |
| Junos OS (MX Series, EX9200 Series) 22.1 | 22.1R3-S2 or later |
| Junos OS (MX Series, EX9200 Series) 22.2 | 22.2R3-S2 or later |
| Junos OS (MX Series, EX9200 Series) 22.3 | 22.3R2-S2, 22.3R3 or later |
| Junos OS (MX Series, EX9200 Series) 22.4 | 22.4R1-S2, 22.4R2-S2, 22.4R3 or later |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Unsupported Feature in the UI vulnerability in Juniper Networks Junos OS on MX Series and EX9200 Series allows an unauthenticated, network-based attacker to cause partial impact to the integrity of the device.
If the "tcp-reset" option is added to the "reject" action in an IPv6 filter which matches on "payload-protocol", packets are permitted instead of rejected. This happens because the payload-protocol match criteria is not supported in the kernel filter causing it to accept all packets without taking any other action. As a fix the payload-protocol match will be treated the same as a "next-header" match to avoid this filter bypass.
This issue doesn't affect IPv4 firewall filters.
This issue affects Juniper Networks Junos OS on MX Series and EX9200 Series:
- All versions earlier than 20.4R3-S7;
- 21.1 versions earlier than 21.1R3-S5;
- 21.2 versions earlier than 21.2R3-S5;
- 21.3 versions earlier than 21.3R3-S4;
- 21.4 versions earlier than 21.4R3-S4;
- 22.1 versions earlier than 22.1R3-S2;
- 22.2 versions earlier than 22.2R3-S2;
- 22.3 versions earlier than 22.3R2-S2, 22.3R3;
- 22.4 versions earlier than 22.4R1-S2, 22.4R2-S2, 22.4R3.
Am I affected?
To be exposed to this issue a configuration utilizing an IPv6 firewall filter with the tcp-reset option like the following needs to be present:
[ firewall family inet6 filter <filter name> term <term name> match payload-protocol ] [ firewall family inet6 filter <filter name> term <term name> then reject tcp-reset ]
Workarounds
A workarounds is to replace the payload-protocol match with a next-header match like in the following example:
[ firewall family inet6 filter <filter name> term <term name> match next-header] [ firewall family inet6 filter <filter name> term <term name> then reject tcp-reset ]
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.