CVE-2024-39529
HIGHDescription
A Use of Externally-Controlled Format String vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If DNS Domain Generation Algorithm (DGA) detection or tunnel detection, and DNS-filtering traceoptions are configured, and specific valid transit DNS traffic is received this causes a PFE crash and restart, leading to a Denial of Service. This issue affects Junos OS: * All versions before 21.4R3-S6, * 22.2 versions before 22.2R3-S3, * 22.3 versions before 22.3R3-S3, * 22.4 versions before 22.4R3, * 23.2 versions before 23.2R2.
Is your site exposed to CVE-2024-39529?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | junos |
| juniper | srx100 |
| juniper | srx110 |
| juniper | srx1400 |
| juniper | srx1500 |
| juniper | srx1600 |
| juniper | srx210 |
| juniper | srx220 |
| juniper | srx2300 |
| juniper | srx240 |
| juniper | srx240h2 |
| juniper | srx240m |
| juniper | srx300 |
| juniper | srx320 |
| juniper | srx340 |
| juniper | srx3400 |
| juniper | srx345 |
| juniper | srx3600 |
| juniper | srx380 |
| juniper | srx4000 |
| juniper | srx4100 |
| juniper | srx4200 |
| juniper | srx4300 |
| juniper | srx4600 |
| juniper | srx4700 |
| juniper | srx5000 |
| juniper | srx5400 |
| juniper | srx550 |
| juniper | srx550_hm |
| juniper | srx550m |
| juniper | srx5600 |
| juniper | srx5800 |
| juniper | srx650 |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2024-39529? +
How severe is CVE-2024-39529? +
What products are affected by CVE-2024-39529? +
How do I check if I'm vulnerable to CVE-2024-39529? +
Related Vulnerabilities
Solar FTP Server fails to properly handle format strings passed to the USER command. When a specially crafted string containing …
WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application …
ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending …
A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort …
An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly …
In versions of Zend Server 8.5 and prior to version 9.2 a format string injection was discovered. Reported by Dylan …