CVE-2026-57031: Juniper Junos MX Series Firewall Filter Bypass Vulnerability

Technical summary

CVE-2026-57031 stems from improper exception handling in the packet forwarding engine (PFE) of Juniper MX Series routers. Specifically, when subscribers are configured on static interfaces, the ingress firewall filter enforcement logic is not invoked. The vulnerability manifests across hardware lineups including MPC10/11 line cards, LC4800/9600/4802, and the MX304 model. An adjacent attacker—someone with network proximity or direct subscriber access—can craft or forward packets that would normally be blocked by configured ingress policies, including protocol-level restrictions and bandwidth controls. The issue does not affect confidentiality and is localized to adjacent network segments; the CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) reflects an adjacent attack vector with low complexity and changed scope but limited integrity impact.

Business impact

For service providers and enterprises running MX Series routers, this vulnerability undermines firewall policy enforcement at the subscriber edge. If your network relies on ingress filters to enforce SLA bandwidth limits, protocol restrictions, or DDoS mitigation on subscriber connections, those controls are silently bypassed on affected hardware and software combinations. The practical impact depends on whether subscriber-facing interfaces on your routers run vulnerable versions and whether attackers or misconfigured subscribers have network access. In a multi-tenant or peering scenario, this could allow one subscriber to disrupt or exceed service commitments without triggering expected rate-limiting or filtering.

Affected systems

Junos OS on MX Series routers with the following hardware and software combinations are vulnerable: MPC10/11, LC4800/9600/4802 line cards and MX304 devices running Junos 23.2 (23.2R2-S1 through before 23.2R2-S7), 23.4 (23.4R2 through before 23.4R2-S7), 24.2 (before 24.2R2-S3), 24.4 (before 24.4R2-S2), and 25.2 (before 25.2R2). The vulnerability is specific to subscribers configured on static interfaces; other interface types or dynamic subscriber configurations may not be affected. Verify your exact hardware model, line card type, and Junos version against these ranges to determine exposure.

Exploitability

Exploitation requires network adjacency—the attacker must be on the same local network segment as the vulnerable router or have subscriber access to it. No authentication is needed, and exploitation is straightforward: an adjacent attacker simply sends packets that would normally be filtered, and due to the missing exception check, the PFE forwards them uncontested. This is not a remote attack and does not require user interaction or special conditions; it is a logic flaw that is exploitable on demand once network access is gained. The low complexity and lack of privilege requirements make it practically exploitable in environments where subscriber or peer networks are semi-trusted but not fully isolated.

Remediation

Upgrade Junos OS to patched versions: 23.2R2-S7 or later, 23.4R2-S7 or later, 24.2R2-S3 or later, 24.4R2-S2 or later, or 25.2R2 or later. The specific patch version depends on which release train your deployment follows. If you cannot patch immediately, restrict network access to affected subscriber interfaces, disable static subscriber configurations on vulnerable hardware variants where operationally feasible, or apply additional upstream filtering on adjacent network segments to compensate for the missing ingress filters. Coordinate with your Juniper account team to validate patch availability for your specific Junos version and hardware combination before scheduling maintenance.

Patch guidance

Juniper has released patched versions across all affected release branches. Identify your current Junos version and hardware configuration (show version and show chassis hardware). Cross-reference against the affected ranges listed above. If your version falls within a vulnerable range, plan an upgrade to the next stable patched release. Test patches in a lab environment if your MX Series routers handle production subscriber traffic. Patched versions should be validated for any other critical security issues and operational compatibility before deployment. Maintain a staged rollout plan to minimize service interruption on live networks.

Detection guidance

Monitor ingress firewall filter statistics on affected MX Series routers. If configured filters show zero or suspiciously low match counts while subscriber traffic is active, this may indicate filters are being bypassed. Enable detailed packet accounting and flow logging on subscriber-facing interfaces to capture traffic that should have been blocked. Look for traffic patterns that violate your configured policy—such as traffic from protocols you've blocked or bandwidth exceeding rate limits. Logs alone may not reveal the bypass since PFE exceptions are typically not user-visible; rely on anomalous traffic patterns and policy mismatch as indicators. A network flow analysis tool observing traffic from subscriber interfaces can help confirm if packets are arriving that should have been filtered.

Why prioritize this

Although the CVSS score of 4.7 (MEDIUM) is moderate, the vulnerability directly undermines a core security function—firewall policy enforcement. For service providers and multi-tenant networks, this is a high-impact issue because it affects the isolation and control of subscriber traffic, a foundational operational requirement. The fact that it is not on CISA's KEV list does not reduce its priority for organizations running MX Series routers in subscriber-facing roles. Prioritization should be elevated if your environment relies on MX Series devices for edge filtering, bandwidth management, or multi-tenant isolation. If your routers are in core or backbone positions not serving subscribers, risk is lower.

Risk score, explained

The CVSS 3.1 score of 4.7 reflects the limited scope and direct attack vector. Attack vector is adjacent (not remote), so widespread exploitation across the internet is not possible. Integrity is impacted (policy bypass) but confidentiality and availability are not. The changed scope indicates the impact crosses trust boundaries within the local network. However, the score underweights the operational criticality of firewall enforcement and does not account for the trust assumptions in subscriber networks. Organizations should treat this as higher priority than the base score suggests if firewall policy is a key control for their network security posture.

Frequently asked questions