CVE-2026-33773
Estado: AnalizadaMedia (6.9)—
An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks.
When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked.
No other Junos OS versions are affected.
Detalles técnicos trazas, registros y código del informe original
This issue affects Junos OS on EX Series and QFX Series: * 23.4 version 23.4R2-S6, * 24.2 version 24.2R2-S3.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X
- Puntuación base: 6.9
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.31%
- Percentil entre todas las CVEs puntuadas: 22
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-Other
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-33773",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-33773",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-04-13T17:39:31.771075Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "sirt@juniper.net",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 5.8,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 3.9
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "sirt@juniper.net",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "USER",
"baseScore": 6.9,
"Automatable": "YES",
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"subIntegrityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "MODERATE",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "sirt@juniper.net",
"affectedData": [
{
"vendor": "Juniper Networks",
"product": "Junos OS",
"versions": [
{
"status": "affected",
"version": "23.4R2-S6",
"lessThan": "23.4R2-S7",
"versionType": "semver"
},
{
"status": "affected",
"version": "24.2R2-S3",
"lessThan": "24.2R2-S4",
"versionType": "semver"
}
],
"platforms": [
"EX Series",
"QFX Series"
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-04-09T22:16:25.590",
"references": [
{
"url": "https://kb.juniper.net/JSA107815",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"source": "sirt@juniper.net"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks.\n\nWhen the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked.\n\nThis issue affects Junos OS on EX Series and QFX Series:\n * 23.4 version 23.4R2-S6,\n * 24.2 version 24.2R2-S3.\n\n\nNo other Junos OS versions are affected."
}
],
"lastModified": "2026-06-17T10:38:04.373",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D9A36E5-A1BB-46E1-91B6-91A4C40C1B59"
},
{
"criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "619B5EA0-0369-4AFE-AD8B-A3A22B326F9E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "3B3302CB-457F-4BD2-B80B-F70FB4C4542E"
},
{
"criteria": "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "979C3597-C53B-4F4B-9EA7-126DA036C86D"
},
{
"criteria": "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "47DAF5E7-E610-4D74-8573-41C16D642837"
},
{
"criteria": "cpe:2.3:h:juniper:ex4000:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "152FD759-F5D2-4ACE-ADD6-7FE89B31D961"
},
{
"criteria": "cpe:2.3:h:juniper:ex4100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C2521C83-E8F2-4621-9727-75BB3FC11E64"
},
{
"criteria": "cpe:2.3:h:juniper:ex4100-f:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6F496D19-D28C-4517-90A3-90EC62BC5D79"
},
{
"criteria": "cpe:2.3:h:juniper:ex4100-h:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7DA4A8C7-EBC0-449E-BD37-69FABDC917C2"
},
{
"criteria": "cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E594D6DC-87F6-40D2-8268-ED6021462168"
},
{
"criteria": "cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4B43F6CB-0595-4957-8B3B-ADD4EA84D8C2"
},
{
"criteria": "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D1BB20B5-EA30-4E8E-9055-2E629648436A"
},
{
"criteria": "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2B425BB1-3C78-42B1-A6C1-216E514191F0"
},
{
"criteria": "cpe:2.3:h:juniper:ex9204:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "86E82CE3-F43D-4B29-A64D-B14ADB6CC357"
},
{
"criteria": "cpe:2.3:h:juniper:ex9208:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "13C0199E-B9F0-41D3-B625-083990517CDF"
},
{
"criteria": "cpe:2.3:h:juniper:ex9214:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8790B456-DFC7-4E82-9A0C-C89787139B79"
},
{
"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550"
},
{
"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "79A8847B-4F98-4949-8639-5CD2B411D10F"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "09EBDE4B-764F-4DF1-844A-BB8A52CD53EF"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "AB58A6E9-FFCF-4331-AC3B-45C37BD1943E"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "EDC5478F-A047-4F6D-BB11-0077A74C0174"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D877320D-1997-4B66-B11B-864020C755E1"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D193BEBD-9436-468D-B89E-D5720603451D"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5230-64cd:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9F3D09BE-C16F-4E77-B6FB-C0C58BBD7675"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5240:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9ABF8F9D-45C1-4554-A213-435A68709FCB"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5241:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "685120A6-7005-4ECB-A37F-0F225BB92676"
},
{
"criteria": "cpe:2.3:h:juniper:qfx5700:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "C7D6C74F-E85F-4D62-BDAF-FE619B467C76"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "sirt@juniper.net"
}