This vulnerability (CWE-754) in Juniper Networks Junos OS affects the packet forwarding engine on MX Series devices with MPC10/11, LC4800/9600/4802, and MX304 hardware. Specifically, ingress firewall filters are not enforced for subscribers configured on static interfaces, enabling adjacent subscribers to bypass firewall filters that control protocol and bandwidth restrictions. The affected software versions include 23.2R2-S1 through before 23.2R2-S7, 23.4R2 through before 23.4R2-S7, versions before 24.2R2-S3, before 24.4R2-S2, and before 25.2R2. The CVSS 3.1 base score is 4.7 (medium severity), with attack vector adjacent network, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. The vendor provides patches and manages remediation for this cloud-hosted service.

Adjacent subscribers on affected Junos OS MX Series devices can bypass ingress firewall filters, resulting in the failure to enforce protocol-level and upstream bandwidth limitations. This leads to a loss of integrity controls over network traffic filtering but does not impact confidentiality or availability. The issue affects network security policies relying on firewall filters to isolate or limit subscriber traffic.

A patch is available for this vulnerability. Since this is a cloud-hosted service, Juniper Networks manages remediation server-side. Users should refer to the official vendor advisory for patch deployment and confirm that their devices are updated to fixed versions. No additional mitigations are specified by the vendor.