{"cve":"CVE-2024-39534","nvd":{"published":"2024-10-11T16:15:06.970","modified":"2026-06-17T07:42:09.000","status":"Analyzed","description":"An Incorrect Comparison vulnerability in the local address verification API of Juniper Networks Junos OS Evolved allows an unauthenticated network-adjacent attacker to create sessions or send traffic to the device using the network and broadcast address of the subnet assigned to an interface. This is unintended and unexpected behavior and can allow an attacker to bypass certain compensating controls, such as stateless firewall filters.\n\nThis issue affects Junos OS Evolved: \n\n\n\n  *  All versions before 21.4R3-S8-EVO, \n  *  22.2-EVO before 22.2R3-S4-EVO, \n  *  22.3-EVO before 22.3R3-S4-EVO, \n  *  22.4-EVO before 22.4R3-S3-EVO, \n  *  23.2-EVO before 23.2R2-S1-EVO, \n  *  23.4-EVO before 23.4R1-S2-EVO, 23.4R2-EVO.","cvss_v4":{"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-697"],"references":["https://supportportal.juniper.net/JSA88105"],"products":["juniper:junos_os_evolved"],"source":"nvd","synced_at":"2026-10-19T21:55:31.737901711+00:00"},"epss":{"cve":"CVE-2024-39534","score":0.00657,"percentile":0.51435,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}