CVE-2022-22250
CVE-2022-22250 is a medium-severity vulnerability in Juniper Junos with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-664.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- EPSS exploit prediction: 0% (21st percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-664
- Affected product: Juniper Junos
- Published:
- Last modified:
Description
An Improper Control of a Resource Through its Lifetime vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows unauthenticated adjacent attacker to cause a Denial of Service (DoS). In an EVPN-MPLS scenario, if MAC is learned locally on an access interface but later a request to delete is received indicating that the MAC was learnt remotely, this can lead to memory corruption which can result in line card crash and reload. This issue affects: Juniper Networks Junos OS All versions 17.3R1 and later versions prior to 19.2R3-S5; 19.3 versions prior to 19.3R3-S5; 19.4 versions prior to 19.4R2-S6, 19.4R3-S8; 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R2; 21.4 versions prior to 21.4R1-S1, 21.4R2. Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S3-EVO; 21.1-EVO version 21.1R1-EVO and later versions; 21.2-EVO versions prior to 21.2R3-EVO; 21.3-EVO versions prior to 21.3R2-EVO; 21.4-EVO versions prior to 21.4R1-S1-EVO, 21.4R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 17.3R1.
Frequently asked questions
- What is CVE-2022-22250?
- An Improper Control of a Resource Through its Lifetime vulnerability in Packet Forwarding Engine (PFE) of Juniper Networks Junos OS and Junos OS Evolved allows unauthenticated adjacent attacker to cause a Denial of Service (DoS). In an EVPN-MPLS scenario, if MAC is learned locally on an access interface but later a request to delete is received indicating that the MAC was learnt remotely, this can lead to memory corruption which can result in line card crash and reload. This issue affects: Juniper Networks Junos OS All versions 17.3R1 and later versions prior to 19.2R3-S5; 19.3 versions prior to 19.3R3-S5; 19.4 versions prior to 19.4R2-S6, 19.4R3-S8; 20.1 version 20.1R1 and later versions; 20.2 versions prior to 20.2R3-S4; 20.3 versions prior to 20.3R3-S3; 20.4 versions prior to 20.4R3-S3; 21.1 versions prior to 21.1R3-S1; 21.2 versions prior to 21.2R3; 21.3 versions prior to 21.3R2; 21.4 versions prior to 21.4R1-S1, 21.4R2. Juniper Networks Junos OS Evolved All versions prior to 20.4R3-S3-EVO; 21.1-EVO version 21.1R1-EVO and later versions; 21.2-EVO versions prior to 21.2R3-EVO; 21.3-EVO versions prior to 21.3R2-EVO; 21.4-EVO versions prior to 21.4R1-S1-EVO, 21.4R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 17.3R1.
- How severe is CVE-2022-22250?
- CVE-2022-22250 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2022-22250 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-22250?
- CVE-2022-22250 primarily affects Juniper Junos. In total, 334 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2022-22250?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2022-22250 published?
- CVE-2022-22250 was published on 2022-10-18 and last updated on 2026-06-17.
References
Affected products (334)
- cpe:2.3:o:juniper:junos:17.3:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r1-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r2-s5:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s10:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s11:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s12:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s5:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s6:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s7:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s8:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r3-s9:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.3:r4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:-:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s3:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s4:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s5:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s6:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r1-s7:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s1:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s10:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s11:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s12:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s13:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s2:*:*:*:*:*:*
- cpe:2.3:o:juniper:junos:17.4:r2-s3:*:*:*:*:*:*
More vulnerabilities in Juniper Junos
- CVE-2021-0248 — Critical (CVSS 10.0): This issue is not applicable to NFX NextGen Software. On NFX Series devices the use of Hard-coded Credentials in…
- CVE-2021-0211 — Critical (CVSS 10.0): An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing…
- CVE-2020-1614 — Critical (CVSS 10.0): A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function (VNF)…
- CVE-2017-2343 — Critical (CVSS 10.0): The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series…
- CVE-2013-4685 — Critical (CVSS 10.0): Buffer overflow in flowd in Juniper Junos 10.4 before 10.4S14, 11.4 before 11.4R7, 12.1 before 12.1R6, and 12.1X44…
- CVE-2017-2349 — Critical (CVSS 9.9): A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially…
All CVEs affecting Juniper Junos →
Other CWE-664 vulnerabilities
- CVE-2022-27518 — Critical (CVSS 9.8): Unauthenticated remote arbitrary code execution
- CVE-2026-43503 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through…
- CVE-2026-8517 — High (CVSS 8.8): Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who…
- CVE-2019-5816 — High (CVSS 8.8): Process lifetime issue in Chrome in Google Chrome on Android prior to 74.0.3729.108 allowed a remote attacker to…
- CVE-2022-20856 — High (CVSS 8.6): A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) Mobility messages in…
- CVE-2016-8763 — High (CVSS 7.8): The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software…