LiveActive security incident?Get immediate response
CVE Record

CVE-2020-1627: Junos OS: vMX and MX150: Denial of Service vulnerability in packet processing

A vulnerability in Juniper Networks Junos OS on vMX and MX150 devices may allow an attacker to cause a Denial of Service (DoS) by sending specific packets requiring special processing in microcode that the flow cache can't handle, causing the riot forwarding daemon to crash. By continuously sending the same specific packets, an attacker can repeatedly crash the riot process causing a sustained Denial of Service. Flow cache is specific to vMX based products and the MX150, and is enabled by default in performance mode. This issue can only be triggered by traffic destined to the device. Transit traffic will not cause the riot daemon to crash. When the issue occurs, a core dump and riot log file entry are generated. For example: /var/crash/core.J-UKERN.mpc0.1557255993.3864.gz /home/pfe/RIOT logs: fpc0 riot[1888]: PANIC in lu_reorder_send_packet_postproc(): fpc0 riot[6655]: PANIC in lu_reorder_send_packet_postproc(): This issue affects Juniper Networks Junos OS: 18.1 versions prior to 18.1R3 on vMX and MX150; 18.2 versions prior to 18.2R3 on vMX and MX150; 18.2X75 versions prior to 18.2X75-D60 on vMX and MX150; 18.3 versions prior to 18.3R3 on vMX and MX150; 18.4 versions prior to 18.4R2 on vMX and MX150; 19.1 versions prior to 19.1R2 on vMX and MX150. This issue does not affect Junos OS versions prior to 18.1R1.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This Junos OS flaw can let a remote unauthenticated attacker crash packet forwarding on affected Juniper vMX and MX150 systems. Repeated device-directed packets can keep the forwarding process down, creating a sustained outage. It affects availability, not data confidentiality or integrity.

Executive priority

Treat as high priority for affected routing infrastructure, especially internet-adjacent or critical-path vMX/MX150 devices. The business risk is service disruption from repeated forwarding crashes, not data theft. Upgrade planning should be handled through normal Juniper maintenance controls.

Technical view

Specific packets destined to the device can trigger microcode processing that the vMX/MX150 flow cache cannot handle, crashing the riot forwarding daemon. Transit traffic is not described as a trigger. A crash produces core dumps and RIOT log PANIC entries in lu_reorder_send_packet_postproc().

Likely exposure

Exposure is limited to Juniper vMX and MX150 running Junos OS 18.1 through 19.1 before the fixed release thresholds listed by Juniper/CVE. Flow cache is specific to these platforms and enabled by default in performance mode.

Exploitation context

The provided sources do not identify active exploitation, and the bundle marks KEV as false. Exploitation requires sending crafted traffic to the device itself. Continuous traffic can repeatedly crash the forwarding daemon and sustain denial of service.

Researcher notes

Key constraints: only vMX and MX150 are named; Junos before 18.1R1 is not affected; transit traffic is not described as exploitable. Validation should focus on version exposure, performance-mode flow cache context, and crash artifacts rather than attempting packet reproduction.

Mitigation direction

  • Upgrade affected Junos OS vMX and MX150 systems to a non-affected release listed by Juniper.
  • Check Juniper advisory JSA11006 for platform-specific upgrade guidance and operational notes.
  • Restrict management and device-destined traffic exposure where operationally feasible.
  • Prioritize systems in performance mode because flow cache is enabled by default there.

Validation and detection

  • Inventory vMX and MX150 devices and record Junos OS release trains and exact builds.
  • Confirm whether versions are before 18.1R3, 18.2R3, 18.2X75-D60, 18.3R3, 18.4R2, or 19.1R2.
  • Review /var/crash and RIOT logs for riot PANIC entries in lu_reorder_send_packet_postproc().
  • Verify controls limit unnecessary traffic destined to affected devices.
  • Confirm upgraded systems are no longer on vulnerable release levels.
Prepared
Confidence
high
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-1627 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2020-1627Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Juniper NetworksJunos OS18.1, 18.2, 18.2X75, 18.3, 18.4, 19.1Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.