CVE-2021-0207
CVE-2021-0207 is a high-severity vulnerability in Juniper Junos with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-436.
Key facts
- Severity: High (CVSS 3.x base score 7.5)
- CVSS v2: 5.0
- EPSS exploit prediction: 1% (66th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-436
- Affected product: Juniper Junos
- Published:
- Last modified:
Description
An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain traffic to pass through the device upon receipt from an ingress interface filtering certain specific types of traffic which is then being redirected to an egress interface on a different VLAN. This causes a Denial of Service (DoS) to those clients sending these particular types of traffic. Such traffic being sent by a client may appear genuine, but is non-standard in nature and should be considered as potentially malicious, and can be targeted to the device, or destined through it for the issue to occur. This issues affects IPv4 and IPv6 traffic. An indicator of compromise may be found by checking log files. You may find that traffic on the input interface has 100% of traffic flowing into the device, yet the egress interface shows 0 pps leaving the device. For example: [show interfaces "interface" statistics detail] Output between two interfaces would reveal something similar to: Ingress, first interface: -------------------- Interface Link Input packets (pps) Output packets (pps) et-0/0/0 Up 9999999999 (9999) 1 (0) -------------------- Egress, second interface: -------------------- Interface Link Input packets (pps) Output packets (pps) et-0/0/1 Up 0 (0) 9999999999 (0) -------------------- Dropped packets will not show up in DDoS monitoring/protection counters as issue is not caused by anti-DDoS protection mechanisms. This issue affects: Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S7 on NFX250, QFX5K Series, EX4600; 17.4 versions prior to 17.4R2-S11, 17.4R3-S3 on NFX250, QFX5K Series, EX4600; 18.1 versions prior to 18.1R3-S9 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4600; 18.2 versions prior to 18.2R3-S3 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600; 18.3 versions prior to 18.3R3-S1 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 18.4 versions prior to 18.4R1-S5, 18.4R2-S3, 18.4R3 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 19.1 versions prior to 19.1R1-S5, 19.1R2-S1, 19.1R3 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 19.2 versions prior to 19.2R1-S5, 19.2R2 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 19.3 versions prior to 19.3R2-S3, 19.3R3 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 19.4 versions prior to 19.4R1-S2, 19.4R2 on NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series. This issue does not affect Junos OS releases prior to 17.2R2.
Frequently asked questions
- What is CVE-2021-0207?
- An improper interpretation conflict of certain data between certain software components within the Juniper Networks Junos OS devices does not allow certain traffic to pass through the device upon receipt from an ingress interface filtering certain specific types of traffic which is then being redirected to an egress interface on a different VLAN. This causes a Denial of Service (DoS) to those clients sending these particular types of traffic. Such traffic being sent by a client may appear genuine, but is non-standard in nature and should be considered as potentially malicious, and can be targeted to the device, or destined through it for the issue to occur. This issues affects IPv4 and IPv6 traffic. An indicator of compromise may be found by checking log files. You may find that traffic on the input interface has 100% of traffic flowing into the device, yet the egress interface shows 0 pps leaving the device. For example: [show interfaces "interface" statistics detail] Output between two interfaces would reveal something similar to: Ingress, first interface: -------------------- Interface Link Input packets (pps) Output packets (pps) et-0/0/0 Up 9999999999 (9999) 1 (0) -------------------- Egress, second interface: -------------------- Interface Link Input packets (pps) Output packets (pps) et-0/0/1 Up 0 (0) 9999999999 (0) -------------------- Dropped packets will not show up in DDoS monitoring/protection counters as issue is not caused by anti-DDoS protection mechanisms. This issue affects: Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S7 on NFX250, QFX5K Series, EX4600; 17.4 versions prior to 17.4R2-S11, 17.4R3-S3 on NFX250, QFX5K Series, EX4600; 18.1 versions prior to 18.1R3-S9 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4600; 18.2 versions prior to 18.2R3-S3 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600; 18.3 versions prior to 18.3R3-S1 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 18.4 versions prior to 18.4R1-S5, 18.4R2-S3, 18.4R3 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 19.1 versions prior to 19.1R1-S5, 19.1R2-S1, 19.1R3 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 19.2 versions prior to 19.2R1-S5, 19.2R2 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 19.3 versions prior to 19.3R2-S3, 19.3R3 on NFX250, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series; 19.4 versions prior to 19.4R1-S2, 19.4R2 on NFX250, NFX350, QFX5K Series, EX2300 Series, EX3400 Series, EX4300 Multigigabit, EX4600 Series. This issue does not affect Junos OS releases prior to 17.2R2.
- How severe is CVE-2021-0207?
- CVE-2021-0207 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2021-0207 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-0207?
- CVE-2021-0207 primarily affects Juniper Junos. In total, 110 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2021-0207?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2021-0207 published?
- CVE-2021-0207 was published on 2021-01-15 and last updated on 2026-06-17.
References
Affected products (110)
- cpe:2.3:o:juniper:junos:17.3:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s5:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3:-:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s5:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s6:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s5:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s6:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s7:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s10:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s5:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s6:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s7:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s8:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s9:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r3-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r3-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:18.1:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:18.1:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:18.1:r2:*:*:*:*:*:*
More vulnerabilities in Juniper Junos
- CVE-2021-0248 — Critical (CVSS 10.0): This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in…
- CVE-2021-0211 — Critical (CVSS 10.0): An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing…
- CVE-2020-1614 — Critical (CVSS 10.0): A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF)…
- CVE-2017-2343 — Critical (CVSS 10.0): The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series…
- CVE-2013-4685 — Critical (CVSS 10.0): Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44…
- CVE-2017-2349 — Critical (CVSS 9.9): A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially…
All CVEs affecting Juniper Junos →
Other CWE-436 vulnerabilities
- CVE-2023-24813 — Critical (CVSS 10.0): Dompdf is an HTML to PDF converter written in php. Due to the difference in the attribute parser of Dompdf and…
- CVE-2026-8034 — Critical (CVSS 9.8): A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that…
- CVE-2021-45327 — Critical (CVSS 9.8): Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable…
- CVE-2020-10180 — Critical (CVSS 9.8): The ESET AV parsing engine allows virus-detection bypass via a crafted BZ2 Checksum field in an archive. This affects…
- CVE-2019-19589 — Critical (CVSS 9.8): The Lever PDF Embedder plugin 4.4 for WordPress does not block the distribution of polyglot PDF documents that are…
- CVE-2026-14198 — Critical (CVSS 9.1): @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching…