GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-21913

Vulnerability from fkie_nvd - Published: 2026-01-15 21:16 - Updated: 2026-06-17 10:19
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
An Incorrect Initialization of Resource vulnerability in the Internal Device Manager (IDM) of Juniper Networks Junos OS on EX4000 models allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). On EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP) a high volume of traffic destined to the device will cause an FXPC crash and restart, which leads to a complete service outage until the device has automatically restarted. The following reboot reason can be seen in the output of 'show chassis routing-engine' and as a log message:   reason=0x4000002 reason_string=0x4000002:watchdog + panic with core dump This issue affects Junos OS on EX4000-48T, EX4000-48P and EX4000-48MP: * 24.4 versions before 24.4R2, * 25.2 versions before 25.2R1-S2, 25.2R2. This issue does not affect versions before 24.4R1 as the first Junos OS version for the EX4000 models was 24.4R1.
References
sirt@juniper.nethttps://kb.juniper.net/JSA106014Vendor Advisory
sirt@juniper.nethttps://supportportal.juniper.net/JSA106014Vendor Advisory
Impacted products
Vendor Product Version
juniper junos 24.4
juniper junos 24.4
juniper junos 24.4
juniper junos 24.4
juniper junos 25.2
juniper junos 25.2
juniper junos 25.2
juniper junos 25.2
juniper ex4000-48mp -
juniper ex4000-48p -
juniper ex4000-48t -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "EX4000-48T",
            "EX4000-48P",
            "EX4000-48MP"
          ],
          "product": "Junos OS",
          "vendor": "Juniper Networks",
          "versions": [
            {
              "lessThan": "24.4R2",
              "status": "affected",
              "version": "24.4",
              "versionType": "semver"
            },
            {
              "lessThan": "25.2R1-S2, 25.2R2",
              "status": "affected",
              "version": "25.2",
              "versionType": "semver"
            },
            {
              "lessThan": "24.4R1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "sirt@juniper.net"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:-:*:*:*:*:*:*",
              "matchCriteriaId": "C452BDCB-34E3-42D3-8909-2312356EB70A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1:*:*:*:*:*:*",
              "matchCriteriaId": "2B8158F2-2028-40E9-955F-CFD581A32F60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s2:*:*:*:*:*:*",
              "matchCriteriaId": "1A7233A1-EC7A-4458-9AE1-835480A03A21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:24.4:r1-s3:*:*:*:*:*:*",
              "matchCriteriaId": "D74087E2-5CAA-4085-8408-EB70EC1D5D91",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "1B7572BB-9C77-4214-9C5F-CC83C7B93E37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r1:*:*:*:*:*:*",
              "matchCriteriaId": "CAADBF98-38BE-40E2-AF1B-9077DCED0809",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r1-s1:*:*:*:*:*:*",
              "matchCriteriaId": "558F0A4C-0C72-4BF1-B2DE-C0D3BFD54BCD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:juniper:junos:25.2:r2:*:*:*:*:*:*",
              "matchCriteriaId": "6C7B9DEB-7472-4010-8717-8050555C2FAD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:juniper:ex4000-48mp:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "62095696-9ECD-4348-9CEF-B2964ADECDC0",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4000-48p:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "5D907C1B-4C3D-4280-B5D9-FA0557B5A72F",
              "vulnerable": false
            },
            {
              "criteria": "cpe:2.3:h:juniper:ex4000-48t:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "4009C8F8-19AE-4DAF-8CF7-0DC5EA76A852",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An Incorrect Initialization of Resource vulnerability in the Internal Device Manager (IDM) of Juniper Networks Junos OS on EX4000 models allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS).\n\nOn EX4000 models with 48 ports (EX4000-48T, EX4000-48P, EX4000-48MP)\u00a0a high volume of traffic destined to the device will cause an FXPC crash and restart, which leads to a complete service outage until the device has automatically restarted.\n\n\n\n\nThe following reboot reason can be seen in the output of \u0027show chassis routing-engine\u0027 and as a log message:\n\n\u00a0 reason=0x4000002 reason_string=0x4000002:watchdog + panic with core dump \n\n\n\n\nThis issue affects Junos OS on EX4000-48T, EX4000-48P and EX4000-48MP:\n\n\n\n  *  24.4 versions before 24.4R2,\n  *  25.2 versions before 25.2R1-S2, 25.2R2.\n\n\n\n\nThis issue does not affect versions before 24.4R1 as the first Junos OS version for the EX4000 models was 24.4R1."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inicializaci\u00f3n incorrecta de recursos en el Administrador de Dispositivos Internos (IDM) de Juniper Networks Junos OS en modelos EX4000 permite a un atacante no autenticado, basado en red, causar una Denegaci\u00f3n de Servicio (DoS).\n\nEn los modelos EX4000 con 48 puertos (EX4000-48T, EX4000-48P, EX4000-48MP), un alto volumen de tr\u00e1fico destinado al dispositivo causar\u00e1 un fallo y reinicio de FXPC, lo que lleva a una interrupci\u00f3n completa del servicio hasta que el dispositivo se haya reiniciado autom\u00e1ticamente.\n\nLa siguiente raz\u00f3n de reinicio se puede ver en la salida de \u0027show chassis routing-engine\u0027 y como un mensaje de registro:\n\nreason=0x4000002 reason_string=0x4000002:watchdog + panic with core dump\n\nEste problema afecta a Junos OS en EX4000-48T, EX4000-48P y EX4000-48MP:\n\n  *  versiones 24.4 anteriores a 24.4R2,\n  *  versiones 25.2 anteriores a 25.2R1-S2, 25.2R2.\n\nEste problema no afecta a las versiones anteriores a 24.4R1, ya que la primera versi\u00f3n de Junos OS para los modelos EX4000 fue 24.4R1."
    }
  ],
  "id": "CVE-2026-21913",
  "lastModified": "2026-06-17T10:19:08.913",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "sirt@juniper.net",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "YES",
          "Recovery": "AUTOMATIC",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "MODERATE"
        },
        "source": "sirt@juniper.net",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-21913",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-15T20:44:57.151563Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-15T21:16:07.537",
  "references": [
    {
      "source": "sirt@juniper.net",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://kb.juniper.net/JSA106014"
    },
    {
      "source": "sirt@juniper.net",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://supportportal.juniper.net/JSA106014"
    }
  ],
  "sourceIdentifier": "sirt@juniper.net",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-665"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.