CVE-2022-22201

Summary

An Improper Validation of Specified Index, Position, or Offset in Input vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause a Denial of Service (DoS). On SRX5000 Series with SPC3, SRX4000 Series, and vSRX, when PowerMode IPsec is configured and a malformed ESP packet matching an established IPsec tunnel is received the PFE crashes. This issue affects Juniper Networks Junos OS on SRX5000 Series with SPC3, SRX4000 Series, and vSRX: All versions prior to 19.4R2-S6, 19.4R3-S7; 20.1 versions prior to 20.1R3-S3; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S2; 21.1 versions prior to 21.1R3; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R1-S2, 21.3R2.

Affected Software

VendorProductVersion RangeStatus
Juniper NetworksJunos OSunspecified < 19.4R2-S6, 19.4R3-S7affected
Juniper NetworksJunos OS20.1 < 20.1R3-S3affected
Juniper NetworksJunos OS20.2 < 20.2R3-S4affected
Juniper NetworksJunos OS20.3 < 20.3R3-S3affected
Juniper NetworksJunos OS20.4 < 20.4R3-S2affected
Juniper NetworksJunos OS21.1 < 21.1R3affected
Juniper NetworksJunos OS21.2 < 21.2R3affected
Juniper NetworksJunos OS21.3 < 21.3R1-S2, 21.3R2affected

Weaknesses

  • CWE-1285: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input
  • Denial of Service (DoS)

Workarounds

There are no known workarounds for this issue.

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References