LiveActive security incident?Get immediate response
CVE Record

CVE-2021-0264: Junos OS and Junos OS Evolved: MX Series with MPC10/MPC11, PTX10003, PTX10008: Line card may crash and restart when traffic is hitting a firewall filter having a term with syslog action configured

A vulnerability in the processing of traffic matching a firewall filter containing a syslog action in Juniper Networks Junos OS on MX Series with MPC10/MPC11 cards installed, PTX10003 and PTX10008 Series devices, will cause the line card to crash and restart, creating a Denial of Service (DoS). Continued receipt and processing of packets matching the firewall filter can create a sustained Denial of Service (DoS) condition. When traffic hits the firewall filter, configured on lo0 or any physical interface on the line card, containing a term with a syslog action (e.g. 'term <name> then syslog'), the affected line card will crash and restart, impacting traffic processing through the ports of the line card. This issue only affects MX Series routers with MPC10 or MPC11 line cards, and PTX10003 or PTX10008 Series packet transport routers. No other platforms or models of line cards are affected by this issue. Note: This issue has also been identified and described in technical service bulletin TSB17931 (login required). This issue affects: Juniper Networks Junos OS on MX Series: 19.3 versions prior to 19.3R3-S2; 19.4 versions prior to 19.4R3-S2; 20.1 versions prior to 20.1R3; 20.2 versions prior to 20.2R2-S2, 20.2R3; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R2. Juniper Networks Junos OS Evolved on PTX10003, PTX10008: All versions prior to 20.4R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 19.3R1.

MediumCVSS 5.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2021-0264 can make specific Juniper router line cards crash and restart when matching traffic hits a firewall filter rule configured with syslog logging. This is an availability issue, not a data theft issue. Business impact is packet forwarding disruption, potentially sustained if matching traffic continues.

Executive priority

Prioritize remediation where affected routers carry critical production or backbone traffic and use syslog firewall-filter actions. This is not a broad compromise risk, but it can disrupt routing availability on high-value network infrastructure.

Technical view

On Junos OS MX Series with MPC10/MPC11 and Junos OS Evolved PTX10003/PTX10008, traffic matching a firewall filter term with syslog action on lo0 or physical interfaces can crash the affected line card. CVSS 3.1 is 5.9 with high availability impact and high attack complexity.

Likely exposure

Exposure appears narrow: affected hardware platforms, vulnerable Junos or Junos OS Evolved versions, and firewall filters containing a syslog action on relevant interfaces. Junos versions before 19.3R1 and other platforms or line cards are stated as unaffected.

Exploitation context

The source bundle does not show CISA KEV listing or active exploitation evidence. Exploitation requires traffic that matches a specific firewall filter configuration, which explains the high attack complexity. Repeated matching traffic could maintain a denial-of-service condition.

Researcher notes

Key constraints are hardware, OS train, and firewall-filter configuration. The vulnerability is CWE-703 and availability-only in CVSS terms. TSB17931 is referenced but login-restricted, so public evidence is mainly the advisory text and CVE records.

Mitigation direction

  • Upgrade Junos OS to the fixed release for the deployed train.
  • Upgrade Junos OS Evolved PTX10003/PTX10008 to 20.4R2-EVO or later.
  • Inventory MX devices for MPC10 or MPC11 line cards.
  • Review firewall filters for terms using syslog action on affected interfaces.
  • If upgrade is delayed, check Juniper JSA11155 and TSB17931 for supported guidance.

Validation and detection

  • Confirm router model, line card type, and Junos release against the affected list.
  • Identify firewall filters applied to lo0 or physical line-card interfaces.
  • Check whether any filter term uses a syslog action.
  • Review line-card crash or restart history during matching traffic periods.
  • Confirm remediated devices run the vendor-listed fixed versions.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-703: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-0264 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.9 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.9CVSS 3.1MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H2.23.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.9Medium
CVSS 3.1 vector shape for CVE-2021-0264Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Juniper NetworksJunos OSunspecifiedListed
Juniper NetworksJunos OS19.3, 19.4, 20.1, 20.2, 20.3, 20.4Listed
Juniper NetworksJunos OS EvolvedunspecifiedListed
Weakness

CWE details

CWE-703

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-703 · source CWE mapping

Improper Check or Handling of Exceptional Conditions

Improper Check or Handling of Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs