CVE-2023-22408

highpriority · track · 0EPSS 0.006 · 51 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.64% (51st) EPSS

CVSS 7.5 · high

Is it mine?

22 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). When an attacker sends an SIP packets with a malformed SDP field then the SIP ALG can not process it which will lead to an FPC crash and restart. Continued receipt of these specific packets will lead to a sustained Denial of Service. This issue can only occur when both below mentioned conditions are fulfilled: 1. Call distribution needs to be enabled: [security alg sip enable-call-distribution] 2. The SIP ALG needs to be enabled, either implicitly / by default or by way of configuration. To confirm whether SIP ALG is enabled on SRX, and MX with SPC3 use the following command: user@host> show security alg status | match sip SIP : Enabled This issue affects Juniper Networks Junos OS on SRX 5000 Series: 20.4 versions prior to 20.4R3-S5; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S3; 21.3 versions prior to 21.3R3-S3; 21.4 versions prior to 21.4R3-S2; 22.1 versions prior to 22.1R2-S2, 22.1R3; 22.2 versions prior to 22.2R3; 22.3 versions prior to 22.3R1-S1, 22.3R2. This issue does not affect Juniper Networks Junos OS versions prior to 20.4R1.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · sirt@juniper.net USexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-129USprimaryCWE-129US

affected products (22)

Products and version ranges known to be affected.

Juniper JUNOSall versionscert_bundDEcpe:/o:juniper:junos:-
Juniper MX Seriesall versionscert_bundDEcpe:/h:juniper:mx:-
Juniper SRX Seriesall versionscert_bundDEcpe:/h:juniper:srx_service_gateways:-
Juniper SRX Series 5000all versionscert_bundDEcpe:/h:juniper:srx_service_gateways:5000
Juniper Networks Inc. JunOS≤ 22.1R3fstec_bduRU
Juniper Networks Inc. JunOS≤ 22.3R2fstec_bduRU
Juniper Networks Inc. JunOS20.4 → 20.4R3-S5fstec_bduRU
Juniper Networks Inc. JunOS21.1 → 21.1R3-S4fstec_bduRU
Juniper Networks Inc. JunOS21.2 → 21.2R3-S3fstec_bduRU
Juniper Networks Inc. JunOS21.3 → 21.3R3-S3fstec_bduRU
Juniper Networks Inc. JunOS21.4 → 21.4R3-S2fstec_bduRU
Juniper Networks Inc. JunOS22.1 → 22.1R2-S2fstec_bduRU
Juniper Networks Inc. JunOS22.2 → 22.2R3fstec_bduRU
Juniper Networks Inc. JunOS22.3 → 22.3R2fstec_bduRU
juniper junos= 20.4nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos= 21.1nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos= 21.2nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos= 21.3nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos= 21.4nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*
juniper junos= 22.1nvdUScpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:*

showing 20 of 22

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2023-0079Juniper JUNOS, SRX Series und MX Series: Schwachstellen ermöglichen Denial of ServiceDeutsch2023-01-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Juniper JUNOS, Juniper SRX Series und Juniper MX Series ausnutzen, um einen Denial of Service Angriff durchzuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2023-01-13modified 2026-06-17

related (958)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-48503US	high8.8OT critical	3.21% (88th)	KEV	2023-08-14
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web conte…
CVE-2017-11292US	high8.8OT critical	11.9% (96th)	KEV	2017-10-22
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index.…
CVE-2013-1322US	high10.0	25.3% (98th)	—	2013-05-15
Microsoft Publisher 2003 SP3 does not properly check table range data, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Invalid…
CVE-2022-35737US	high7.5	23.6% (98th)	Exploit	2022-08-03
SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
CVE-2022-46152US	high8.8	0.49% (42nd)	Exploit	2022-11-29
OP-TEE Trusted OS is the secure side implementation of OP-TEE project, a Trusted Execution Environment. Versions prior to 3.19.0, contain an Improper Validation of Array Index vuln…

+953 more

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan