Security readout for executives and security teams
Plain-English summary
This Junos OS Evolved flaw can let BGP or LDP trust relationships form even when the remote peer did not enable TCP MD5 authentication. That weakens a control meant to keep routing or label sessions limited to trusted peers, creating confidentiality and network stability risk.
Executive priority
Treat this as a moderate network infrastructure issue. It should be remediated through normal maintenance windows unless exposed routing adjacencies or critical backbone systems increase business impact.
Technical view
Junos OS Evolved mishandles TCP MD5 authentication processing for BGP and LDP. A session configured to require MD5 can still establish with a peer that is not configured for MD5. Affected releases are before 20.3R2-S1-EVO, 20.4R2-EVO, and 21.1R2-EVO. Junos OS is not affected.
Likely exposure
Exposure is likely limited to organizations running Juniper Junos OS Evolved in the affected release ranges with BGP or LDP sessions using TCP MD5 authentication. Classic Junos OS is explicitly out of scope based on the provided sources.
Exploitation context
The sources do not report active exploitation, and this CVE is not listed as KEV in the provided bundle. The risk is unauthorized or untrusted routing or LDP session establishment, not a confirmed public exploitation campaign.
Researcher notes
Key unknowns are deployment-specific: reachable peers, routing topology, and whether BGP or LDP MD5 is in use. The bundle provides no exploit proof, workaround details, or indication of affected products beyond Junos OS Evolved.
Mitigation direction
- Upgrade affected Junos OS Evolved systems to a fixed release named by Juniper.
- Prioritize systems running BGP or LDP with TCP MD5 authentication.
- Check Juniper advisory JSA11211 for vendor-supported remediation details.
- Do not treat classic Junos OS as affected based on these sources.
Validation and detection
- Inventory Junos OS Evolved versions across Juniper routing platforms.
- Compare versions against the affected ranges in the CVE record.
- Identify BGP and LDP sessions configured with TCP MD5 authentication.
- Review for unexpected or unauthorized BGP or LDP session establishment.
- Document systems confirmed to run classic Junos OS separately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-755: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-0297 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.juniper.net/JSA11211CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Exceptional Conditions
Improper Handling of Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.