CVE-2023-22405
Juniper Junos ≤ 20.2
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2023-22405 is a medium-severity Improper Preservation of Consistency Between Independent Representations of Shared State (CWE-1250) vulnerability in Juniper Junos. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-26568
Vulnerability Data
An Improper Preservation of Consistency Between Independent Representations of Shared State vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS) to device due to out…
more
of resources. When a device is configured with "service-provider/SP style" switching, and mac-limiting is configured on an Aggregated Ethernet (ae) interface, and then a PFE is restarted or the device is rebooted, mac-limiting doesn't work anymore. Please note that the issue might not be apparent as traffic will continue to flow through the device although the mac table and respective logs will indicate that mac limit is reached. Functionality can be restored by removing and re-adding the MAC limit configuration. This issue affects Juniper Networks Junos OS on QFX5k Series, EX46xx Series: All versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S3; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3 on; 21.4 versions prior to 21.4R3 on; 22.1 versions prior to 22.1R2 on.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V2.3.4V4.2.1V7.1.3V7.6.1
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
SSDLC practices directly address design-level state-consistency flaws during development.
Runtime data monitoring can surface consistency violations after they occur.
Integrity protections such as hashes or signatures can detect or prevent inconsistent state copies.
Resilience mechanisms often include state synchronization or replication protocols that enforce consistency.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles can address distributed-state design yet leave the actual consistency mechanisms unspecified.
Redundancy mechanisms can reduce divergence risk but do not guarantee consistency across independent state copies.
Monitoring can detect inconsistencies after they occur but does not prevent them by design.
Secure SDLC practices can include consistency requirements yet do not specifically mandate distributed-state synchronization.
Application security requirements may specify consistency rules but do not guarantee their implementation.
Change management can coordinate updates across replicas but does not inherently enforce real-time consistency.