dbcve.org
JunosOperating system · Juniper

CVE-2024-30378

MEDIUM · 5.5 CVSS v3.1 Published 2024-04-16
Fix available
A fix is available. Upgrade to 20.4 or later.
See remediation →
57/100
Remediation priority · Elevated
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A Use After Free vulnerability in command processing of Juniper Networks Junos OS on MX Series allows a local, authenticated attacker to cause the broadband edge service manager daemon (bbe-smgd) to crash upon execution of specific CLI commands, creating a Denial of Service (DoS) condition.  The process crashes and restarts automatically. When specific CLI commands are executed, the bbe-smgd daemon attempts to write into an area of memory (mgd socket) that was already closed, causing the process to crash.  This process manages and controls the configuration of broadband subscriber sessions and services.  While the process is unavailable, additional subscribers will not be able to connect to the device, causing a temporary Denial of Service condition. This issue only occurs if Graceful Routing Engine Switchover (GRES) and Subscriber Management are enabled. This issue affects Junos OS: * All versions before 20.4R3-S5, * from 21.1 before 21.1R3-S4, * from 21.2 before 21.2R3-S3, * from 21.3 before 21.3R3-S5, * from 21.4 before 21.4R3-S5, * from 22.1 before 22.1R3, * from 22.2 before 22.2R3, * from 22.3 before 22.3R2;

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Use After Free vulnerability in the bbe-smgd (broadband edge service manager) daemon on Junos OS MX Series routers. When specific CLI commands are executed with GRES and Subscriber Management enabled, the daemon attempts to write to a previously closed mgd socket memory area, causing a process crash and automatic restart. While restarting, new subscribers cannot connect, creating a temporary DoS condition.

MitigationApply Junos OS patches for affected versions (20.4R3-S5+, 21.1R3-S4+, 21.2R3-S3+, 21.3R3-S5+, 21.4R3-S5+, 22.1R3+, 22.2R3+, 22.3R2+). As a temporary mitigation, consider disabling Graceful Routing Engine Switchover (GRES) or Subscriber Management if immediate patching is not feasible.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
JunosOperating system
Affected:< 20.4= 20.4= 21.1= 21.2= 21.3= 21.4= 22.1= 22.2= 22.3

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify device platform and confirm MX Series
    Run 'show chassis hardware' or 'show version' and verify the device model is an MX Series router
    Affected if Device is not an MX Series router (the vulnerability only affects MX Series)
  2. Check Junos OS version
    Run 'show version' and note the full version string (e.g., 21.2R3.4)
    Affected if Version matches: < 20.4, = 20.4, = 21.1, = 21.2, = 21.3, = 21.4, = 22.1, = 22.2, = 22.3
  3. Verify Graceful Routing Engine Switchover status
    Run 'show chassis redundancy' or inspect configuration for 'set chassis redundancy graceful-switchover'
    Affected if GRES is enabled (the vulnerability requires GRES to be active)
  4. Verify Subscriber Management is enabled
    Run 'show subscribers summary' or inspect configuration for 'set system services subscriber-management'
    Affected if Subscriber Management is active/enabled (the vulnerability requires subscriber management to be enabled)
  5. Check bbe-smgd daemon status
    Run 'show system processes daemon bbe-smgd' or equivalent command to verify the daemon is running
    Affected if bbe-smgd daemon is running (the vulnerable process must be active for exploitation)

Device is affected if it is an MX Series router running a vulnerable Junos version (20.4 through 22.3) with both GRES and Subscriber Management simultaneously enabled, and the bbe-smgd daemon is active.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 20.4 or later
Fixed in 20.4
Interim mitigation

Apply Junos OS patches for affected versions (20.4R3-S5+, 21.1R3-S4+, 21.2R3-S3+, 21.3R3-S5+, 21.4R3-S5+, 22.1R3+, 22.2R3+, 22.3R2+). As a temporary mitigation, consider disabling Graceful Routing Engine Switchover (GRES) or Subscriber Management if immediate patching is not feasible.

Recommended fix High confidence

20.4R3-S5, 21.1R3-S4, 21.2R3-S3, 21.3R3-S5, 21.4R3-S5, 22.1R3, 22.2R3, or 22.3R2 (depending on which branch is currently running)

  1. 1. Identify the current Junos OS version on the MX Series device using 'show version'
  2. 2. Verify if Graceful Routing Engine Switchover (GRES) is enabled using 'show configuration chassis redundancy'
  3. 3. Verify if Subscriber Management is enabled using 'show configuration system services subscriber-management'
  4. 4. If both GRES and Subscriber Management are enabled, plan for upgrade to a fixed version
  5. 5. Download the appropriate fixed Junos OS image from Juniper Networks support portal
  6. 6. Upload the new image to the device using 'request system software add <path-to-image>' with 'reboot' option
  7. 7. After reboot, verify the new version is running using 'show version'
  8. 8. Verify the bbe-smgd daemon is stable using 'show system processes extensive | match bbe-smgd'
Caveat Review Juniper release notes for any compatibility concerns; upgrades between major versions may require additional configuration adjustments

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Junos Scoped from the published advisory
  • Consultation6.0 h
  • Implementation8.0 h
  • Testing8.0 h
  • Review / QA4.0 h
26.0 hours of engineering $4,560
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,296.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-30378 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-30378 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data