Junos OS (SRX firewalls)
CVE-2024-30389: EX4300 Series: Firewall filter not blocking egress traffic
An Incorrect Behavior Order vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on EX4300 Series allows an unauthenticated, network-based attacker to cause an integrity impact to networks downstream of the vulnerable device.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Junos OS (EX4300 Series) 21.4 | 21.4R3-S6 or later |
| Junos OS (EX4300 Series) 21.4 | Not affected |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
An Incorrect Behavior Order vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on EX4300 Series allows an unauthenticated, network-based attacker to cause an integrity impact to networks downstream of the vulnerable device.
When an output firewall filter is applied to an interface it doesn't recognize matching packets but permits any traffic. This issue affects Junos OS 21.4 releases from 21.4R1 earlier than 21.4R3-S6. This issue does not affect Junos OS releases earlier than 21.4R1.
Am I affected?
To be affected by this issue an output firewall filter has to be configured on a interface like in the following example:
[ interfaces <interface> unit <unit> family <family> filter output <filter_name> ]
Workarounds
While there is no known workarounds for this issue, it is possible to recover by deactivating and then activating the filter. But please note that the issue might reoccur after a reboot or pfe restart.
Exploitation
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.