CVE-2024-47501: MX304, MX with MPC10/11/LC9600, and EX9200 with EX9200-15C: In a VPLS or Junos Fusion scenario specific show commands cause FPCs to crash

Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.

Affected and fixed versions

Product / branch	Fixed in
Junos OS (MX304, MX with MPC10/11/LC9600, EX9200 with EX9200-15C) 0	21.2R3-S1 or later
Junos OS (MX304, MX with MPC10/11/LC9600, EX9200 with EX9200-15C) 21.3	21.3R3 or later
Junos OS (MX304, MX with MPC10/11/LC9600, EX9200 with EX9200-15C) 21.4	21.4R2 or later

Always confirm against the vendor advisory, which lists every fixed hotfix.

What it is

A NULL Pointer Dereference vulnerability in the

packet forwarding engine (pfe) of Juniper Networks Junos OS on MX304, MX with MPC10/11/LC9600, and EX9200 with EX9200-15C allows a locally authenticated attacker with low privileges to cause a Denial of Service (DoS).

In a VPLS or Junos Fusion scenario, the execution of specific show commands will cause all FPCs hosting VPLS sessions or connecting to satellites to crash and restart.

This issue affects Junos on MX304, MX with MPC10/11/LC9600 and EX9200 with EX9200-15C:

All version before 21.2R3-S1,
21.3 versions before 21.3R3,
21.4 versions before 21.4R2.

Am I affected?

To be exposed to this issue at least a minimal VPLS or Junos Fusion configuration like the following need to be present:

[ routing-instances <RI_name> instance-type vpls ]

[ chassis satellite-management ... ]

Workarounds

There are no known workarounds for this issue.To reduce the risk of exploitation use access lists or firewall filters to limit access to the device only from trusted, administrative networks, hosts, and users.

Exploitation

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.