CVE detail

CVE-2020-1651 — CVE-2020-1651

Published 2020-07-17 · Modified 2026-06-17 · Vendor juniper · Product junos · Source nvd
MEDIUM
severity
CVSS-derived band
6.5
CVSS v3
0–10 scale
0.0045
EPSS probability
exploitation probability, 30d
37.0%
EPSS percentile
percentile vs all CVEs
NOT LISTED
CISA KEV
known exploited catalog

Description

On Juniper Networks MX series, receipt of a stream of specific Layer 2 frames may cause a memory leak resulting in the packet forwarding engine (PFE) on the line card to crash and restart, causing traffic interruption. By continuously sending this stream of specific layer 2 frame, an attacker connected to the same broadcast domain can repeatedly crash the PFE, causing a prolonged Denial of Service (DoS). This issue affects Juniper Networks Junos OS on MX Series: 17.2 versions prior to 17.2R3-S4; 17.2X75 versions prior to 17.2X75-D105.19; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R1-S3, 17.4R2; 18.1 versions prior to 18.1R2. This issue does not affect Juniper Networks Junos OS releases prior to 17.2R1.

Remediation

vendor remediation guidance

The following software releases have been updated to resolve this specific issue: 17.2R3-S4, 17.2X75-D105.19, 17.3R3-S7, 17.4R1-S3, 17.4R2, 18.1R2, 18.2R1, 18.2X75-D10, and all subsequent releases.

workarounds

There are no available workarounds for this issue.

ProductVulnerable rangeFixed versionAdvisory
Juniper Networks Junos OS>=17.2<17.2R3-S417.2R3-S4advisory ↗
Juniper Networks Junos OS>=17.2X75<17.2X75-D105.1917.2X75-D105.19advisory ↗
Juniper Networks Junos OS>=17.3<17.3R3-S717.3R3-S7advisory ↗
Juniper Networks Junos OS>=17.4<17.4R1-S3, 17.4R217.4R1-S3, 17.4R2advisory ↗
Juniper Networks Junos OS>=18.1<18.1R218.1R2advisory ↗

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.