Cyber Resilience

CVE-2023-36834

Juniper Junos 20.1 … 21.4

Published
14 July 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0030 23th percentile
Risk Priority 49 floored blend · peak EPSS

Summary

CVE-2023-36834 is a medium-severity Incomplete Internal State Distinction (CWE-372) vulnerability in Juniper Junos. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

An Incomplete Internal State Distinction vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series allows an adjacent attacker to cause a Denial of Service (DoS). If an SRX is configured…

more

in L2 transparent mode the receipt of a specific genuine packet can cause a single Packet Processing Engines (PPE) component of the PFE to run into a loop, which in turn will render the PPE unavailable. Each packet will cause one PPE to get into a loop, leading to a gradual performance degradation until all PPEs are unavailable and all traffic processing stops. To recover the affected FPC need to be restarted. This issue affects Juniper Networks Junos OS on SRX 4600 and SRX 5000 Series: 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S7; 20.3 version 20.3R1 and later versions; 20.4 versions prior to 20.4R3-S7; 21.1 versions prior to 21.1R3-S5; 21.2 versions prior to 21.2R3-S3; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S1; 22.1 versions prior to 22.1R3; 22.2 versions prior to 22.2R2; 22.3 versions prior to 22.3R1-S1, 22.3R2.

CWE(s)
CWE-372

Related Threats

MITRE ATT&CK Enterprise Techniques

T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
T1556 Modify Authentication Process Defense Impairment
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-47503Same product: Juniper Junos
CVE-2024-39561Same product: Juniper Junos
CVE-2024-47504Same product: Juniper Junos
CVE-2023-22408Same product: Juniper Junos
CVE-2024-30405Same product: Juniper Junos
CVE-2024-30398Same product: Juniper Junos
CVE-2025-52981Same product: Juniper Junos
CVE-2025-59968Same product: Juniper Srx4600
CVE-2026-21914Same product: Juniper Junos
CVE-2025-6549Same product: Juniper Junos

Affected Assets

juniper
junos
20.1, 20.2, 20.3, 20.4, 21.1

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC activities directly address proper state-machine design and testing that prevent incomplete state distinction.

ID.RA-01 partial match
prevents

Identifying recorded vulnerabilities can surface this class of state-management flaw during assessments.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect state-machine flaws that manifest as incomplete internal state distinction.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle practices can include state-machine validation and invariant checks that reduce incomplete internal state errors.

A.8.26 Application security requirements partial match
prevents

Explicit application security requirements can mandate state-transition validation and error-state handling.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage explicit state modelling and fail-safe transitions.

A.8.28 Secure coding partial match
prevents

Secure coding standards can require defensive checks against invalid or ambiguous internal states.

A.8.32 Change management partial match
prevents

Change-management procedures may indirectly catch state-related defects during release reviews.

References