Security readout for executives and security teams
Plain-English summary
This vulnerability can make certain Juniper PTX core routing platforms restart forwarding components when they process specific MPLS traffic under a narrow interface configuration. The business impact is service disruption, not data theft. Risk is highest for networks where affected PTX devices handle MPLS traffic from less trusted adjacent networks.
Executive priority
Prioritize remediation for affected PTX routers in production MPLS paths, especially where adjacent traffic sources are not tightly controlled. This is a service-availability issue with narrow prerequisites, so urgency should be driven by network criticality and confirmed configuration exposure.
Technical view
CVE-2022-22202 is CWE-755 improper exceptional-condition handling in Junos OS on specific PTX Series FPCs. An unauthenticated adjacent MPLS-based attacker can crash dcpfe, causing FPC restart. Repeated triggering can sustain denial of service. Exposure requires affected PTX hardware, vulnerable Junos release, multiple units on the ingress interface, and at least one unit without family mpls configured.
Likely exposure
Exposure appears limited to listed Juniper PTX Series devices and specific FPCs running vulnerable Junos OS versions with the described multi-unit ingress interface configuration. No other platforms are identified as affected in the source bundle.
Exploitation context
The CVSS 3.1 score is 6.5 medium with adjacent attack vector, no privileges, no user interaction, and high availability impact. The bundle does not cite CISA KEV listing or other evidence of active exploitation.
Researcher notes
The source bundle provides strong affected-version and configuration detail but no exploit samples, observed exploitation, or KEV evidence. Analysis should focus on asset/version/configuration matching and operational indicators of FPC restarts rather than assuming broad internet exposure.
Mitigation direction
- Upgrade affected PTX devices to Junos OS fixed releases listed by Juniper.
- Review Juniper JSA69706 for approved workarounds and platform-specific guidance.
- Inventory MPLS-facing PTX interfaces for the vulnerable multi-unit configuration pattern.
- Where vendor-approved, remove or redesign risky multi-unit ingress interface configurations.
- Prioritize devices carrying critical MPLS transport or customer-facing traffic.
Validation and detection
- Identify PTX1000, PTX3000 NextGen, PTX5000, PTX10002-60C, PTX10008, and PTX10016 assets.
- Compare installed Junos OS versions against the fixed release thresholds in the advisory.
- Check ingress interfaces with multiple units for any unit lacking family mpls.
- Review operational logs for dcpfe crashes and unexpected FPC restarts.
- Confirm post-upgrade versions are at or above the fixed Junos OS releases.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-755: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-22202 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://kb.juniper.net/JSA69706CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Handling of Exceptional Conditions
Improper Handling of Exceptional Conditions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.