CVE-2022-22211 is a high-severity Denial of Service (DoS) vulnerability affecting Juniper Networks Junos OS Evolved running on PTX Series routers. The vulnerability arises due to a limitless resource allocation flaw in the Flexible PIC Concentrator (FPC) resources, specifically related to the allocation of GUID (Globally Unique Identifier) space. An unprivileged attacker can exploit this by continuously polling the SNMP jnxCosQstatTable, which leads to exhaustion of the GUID space on the FPC. When the GUID space is depleted, the evo-aftmand-bt process responsible for managing certain FPC resources crashes, triggering syslog messages indicating the failure and causing the FPC to become unreachable. This results in a denial of service condition where the affected FPC resources stop functioning and require manual reboot to recover, as they do not self-heal. The vulnerability affects multiple versions of Junos OS Evolved on PTX Series, including all versions prior to 20.4R3-S4-EVO and several subsequent releases up to 22.1R2-EVO. The vulnerability does not require authentication or user interaction, and can be triggered remotely over the network by sending crafted SNMP requests. The CVSS 3.1 base score is 7.5, reflecting a high severity due to network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (no confidentiality or integrity impact). This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). No known exploits in the wild have been reported, but the ease of exploitation and impact on critical network infrastructure make it a significant threat to organizations using affected Juniper PTX routers.

For European organizations, the impact of this vulnerability can be substantial, especially for those relying on Juniper PTX Series routers for core network routing and infrastructure. The PTX Series routers are commonly deployed in large enterprise networks, telecommunications providers, and data centers. A successful exploitation results in denial of service of critical routing components, potentially disrupting network connectivity, causing outages, and impacting business continuity. This can affect service providers delivering internet, cloud, or managed services, as well as enterprises with critical internal networks. The manual intervention required to recover from the DoS condition increases operational overhead and downtime. Given the vulnerability can be triggered remotely without authentication, it poses a risk of targeted attacks or opportunistic scanning by threat actors. The lack of confidentiality or integrity impact limits data breach risks, but availability disruption in network infrastructure can have cascading effects on dependent services and applications. Organizations in Europe with critical infrastructure or high availability requirements should prioritize addressing this vulnerability to maintain network resilience and service reliability.

1. Immediate patching: Upgrade Junos OS Evolved on PTX Series routers to fixed versions as recommended by Juniper Networks (versions 20.4R3-S4-EVO and later patched releases). 2. SNMP access control: Restrict SNMP access to trusted management networks only, using access control lists (ACLs) or firewall rules to prevent unauthorized external polling of the jnxCosQstatTable. 3. Monitoring and alerting: Implement monitoring of FPC resource usage and syslog messages related to evo-aftmand-bt process failures to detect early signs of exploitation or resource exhaustion. 4. Rate limiting: Where possible, apply rate limiting on SNMP queries targeting the jnxCosQstatTable to mitigate excessive polling attempts. 5. Network segmentation: Isolate management interfaces and SNMP services from general user or internet-facing networks to reduce exposure. 6. Incident response readiness: Prepare operational procedures for manual reboot of affected FPCs to minimize downtime if an attack occurs. 7. Vendor communication: Stay updated with Juniper advisories and apply any additional recommended mitigations or patches promptly. These steps go beyond generic advice by focusing on controlling SNMP access, monitoring specific process failures, and operational readiness for recovery.