CVE-2026-33773
Full vulnerability record from the local CVENow database.
Description
An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks. When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked. This issue affects Junos OS on EX Series and QFX Series: * 23.4 version 23.4R2-S6, * 24.2 version 24.2R2-S3. No other Junos OS versions are affected.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-09 22:16:25.590000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-33773",
"sourceIdentifier": "[email protected]",
"published": "2026-04-09T22:16:25.590",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks.\n\nWhen the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked.\n\nThis issue affects Junos OS on EX Series and QFX Series:\n * 23.4 version 23.4R2-S6,\n * 24.2 version 24.2R2-S3.\n\n\nNo other Junos OS versions are affected."
},
{
"lang": "es",
"value": "Una vulnerabilidad de inicialización incorrecta de recurso en el motor de reenvío de paquetes (pfe) de Juniper Networks Junos OS en dispositivos específicos de las series EX y QFX permite a un atacante no autenticado y basado en red causar un impacto en la integridad en las redes descendentes.\n\nCuando se aplica el mismo filtro de familia inet o inet6 en una interfaz IRB y en una interfaz física como filtro de salida en dispositivos EX4100, EX4400, EX4650 y QFX5120, solo se aplicará uno de los dos filtros, lo que puede llevar a que el tráfico se envíe por una de estas interfaces que debería haber sido bloqueado.\n\nEste problema afecta a Junos OS en las series EX y QFX:\n * versión 23.4 23.4R2-S6,\n * versión 24.2 24.2R2-S3.\n\nNinguna otra versión de Junos OS se ve afectada."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Juniper Networks",
"product": "Junos OS",
"defaultStatus": "unaffected",
"platforms": [
"EX Series",
"QFX Series"
],
"versions": [
{
"version": "23.4R2-S6",
"lessThan": "23.4R2-S7",
"versionType": "semver",
"status": "affected"
},
{
"version": "24.2R2-S3",
"lessThan": "24.2R2-S4",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "YES",
"Recovery": "USER",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "MODERATE",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-13T17:39:31.771075Z",
"id": "CVE-2026-33773",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:23.4:r2-s6:*:*:*:*:*:*",
"matchCriteriaId": "4D9A36E5-A1BB-46E1-91B6-91A4C40C1B59"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:juniper:junos:24.2:r2-s3:*:*:*:*:*:*",
"matchCriteriaId": "619B5EA0-0369-4AFE-AD8B-A3A22B326F9E"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex2300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B3302CB-457F-4BD2-B80B-F70FB4C4542E"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex2300-c:-:*:*:*:*:*:*:*",
"matchCriteriaId": "979C3597-C53B-4F4B-9EA7-126DA036C86D"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex3400:-:*:*:*:*:*:*:*",
"matchCriteriaId": "47DAF5E7-E610-4D74-8573-41C16D642837"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex4000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "152FD759-F5D2-4ACE-ADD6-7FE89B31D961"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex4100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C2521C83-E8F2-4621-9727-75BB3FC11E64"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex4100-f:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6F496D19-D28C-4517-90A3-90EC62BC5D79"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex4100-h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7DA4A8C7-EBC0-449E-BD37-69FABDC917C2"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex4300:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E594D6DC-87F6-40D2-8268-ED6021462168"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex4400:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4B43F6CB-0595-4957-8B3B-ADD4EA84D8C2"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex4600:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D1BB20B5-EA30-4E8E-9055-2E629648436A"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex4650:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B425BB1-3C78-42B1-A6C1-216E514191F0"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex9204:-:*:*:*:*:*:*:*",
"matchCriteriaId": "86E82CE3-F43D-4B29-A64D-B14ADB6CC357"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex9208:-:*:*:*:*:*:*:*",
"matchCriteriaId": "13C0199E-B9F0-41D3-B625-083990517CDF"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:ex9214:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8790B456-DFC7-4E82-9A0C-C89787139B79"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx10008:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1453E42A-77B3-4922-8EC3-1A5668C39550"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx10016:-:*:*:*:*:*:*:*",
"matchCriteriaId": "26408465-BD6A-4416-B98E-691A5F651080"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5110:-:*:*:*:*:*:*:*",
"matchCriteriaId": "79A8847B-4F98-4949-8639-5CD2B411D10F"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5120:-:*:*:*:*:*:*:*",
"matchCriteriaId": "09EBDE4B-764F-4DF1-844A-BB8A52CD53EF"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5130:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AB58A6E9-FFCF-4331-AC3B-45C37BD1943E"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5200:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EDC5478F-A047-4F6D-BB11-0077A74C0174"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5210:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D877320D-1997-4B66-B11B-864020C755E1"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5220:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D193BEBD-9436-468D-B89E-D5720603451D"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5230-64cd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9F3D09BE-C16F-4E77-B6FB-C0C58BBD7675"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5240:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9ABF8F9D-45C1-4554-A213-435A68709FCB"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5241:-:*:*:*:*:*:*:*",
"matchCriteriaId": "685120A6-7005-4ECB-A37F-0F225BB92676"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:h:juniper:qfx5700:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C7D6C74F-E85F-4D62-BDAF-FE619B467C76"
}
]
}
]
}
],
"references": [
{
"url": "https://kb.juniper.net/JSA107815",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
}
]
}