CVE detail

CVE-2021-0276 — CVE-2021-0276

Published 2021-07-15 · Modified 2026-06-17 · Vendor juniper · Product steel-belted_radius_carrier · Source nvd

CRITICAL

severity

CVSS-derived band

9.8

CVSS v3

0–10 scale

0.0231

EPSS probability

exploitation probability, 30d

82.0%

EPSS percentile

percentile vs all CVEs

NOT LISTED

CISA KEV

known exploited catalog

Description

A stack-based Buffer Overflow vulnerability in Juniper Networks SBR Carrier with EAP (Extensible Authentication Protocol) authentication configured, allows an attacker sending specific packets causing the radius daemon to crash resulting with a Denial of Service (DoS) or leading to remote code execution (RCE). By continuously sending this specific packets, an attacker can repeatedly crash the radius daemon, causing a sustained Denial of Service (DoS). This issue affects Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R19; 8.5.0 versions prior to 8.5.0R10; 8.6.0 versions prior to 8.6.0R4.

Remediation

vendor remediation guidance

The following software releases have been updated to resolve this specific issue: 8.4.1R19, 8.5.0R10, 8.6.0R4 and all subsequent releases.

workarounds

There are no viable workarounds for this issue.

Product	Vulnerable range	Fixed version	Advisory
Juniper Networks SBR Carrier	>=8.4.1<8.4.1R19	8.4.1R19	advisory ↗
Juniper Networks SBR Carrier	>=8.5.0<8.5.0R10	8.5.0R10	advisory ↗
Juniper Networks SBR Carrier	>=8.6.0<8.6.0R4	8.6.0R4	advisory ↗

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.