A vulnerability in the Distance Vector Multicast Routing Protocol (DVMRP) of Juniper Networks Junos OS on the QFX10K Series switches allows an attacker to trigger a packet forwarding loop, leading to a partial Denial of Service (DoS). The issue is caused by DVMRP packets looping on a multi-homed Ethernet Segment Identifier (ESI) when VXLAN is configured. DVMRP packets received on a multi-homed ESI are sent to the peer, and then incorrectly forwarded out the same ESI, violating the split horizon rule. This issue only affects QFX10K Series switches, including the QFX10002, QFX10008, and QFX10016. Other products and platforms are unaffected by this vulnerability. This issue affects Juniper Networks Junos OS on QFX10K Series: 17.3 versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 version 18.2R1 and later versions; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S9, 18.4R3-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R3; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2.
Published 2021-07-15 20:15:11
Updated 2021-07-28 19:13:20
View at NVD,   CVE.org
Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2021-0295

0.08%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 34 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-0295

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
2.9
LOW AV:A/AC:M/Au:N/C:N/I:N/A:P
5.5
2.9
NIST
6.1
MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
2.8
2.7
Juniper Networks, Inc.

CWE ids for CVE-2021-0295

  • The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
    Assigned by:
    • nvd@nist.gov (Primary)
    • sirt@juniper.net (Secondary)

References for CVE-2021-0295

  • https://kb.juniper.net/JSA11208
    2021-07 Security Bulletin: Junos OS: QFX10K Series: Denial of Service (DoS) upon receipt of DVMRP packets received on multi-homing ESI in VXLAN. (CVE-2021-0295) - Juniper Networks
    Vendor Advisory

Products affected by CVE-2021-0295

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!