Marco Lux

An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the device. This issue is caused by the use of an insecure function allowing an attacker to overwrite arbitrary memory. The estimated number of potentially affected devices worldwide is over 11,500, with the majority located in South Korea, followed by the USA, Indonesia, and India. There are no reports of this vulnerability being exploited in real-world attacks.

The Service Location Protocol (SLP) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor. The vulnerability is being actively exploited to launch massive DoS amplification attacks. Approximately 54,000 vulnerable devices in 2,000 organizations have been identified.