An incorrect initialization of resources in Juniper’s packet forwarding engine (CWE‑1419, NVD‑CWE‑Other) causes the system to apply only one of two identical egress filters when they are configured on an IRB and a physical interface. The result is that traffic that should be blocked may be sent out an interface that was intended to remain closed, exposing downstream networks to data leakage and undermining the intended firewall policy. The vulnerability is exploitable by an unauthenticated network-based attacker and can let malicious traffic violate network segmentation and egress controls, thereby harming confidentiality and integrity.

Juniper Networks Junos OS on EX4100, EX4400, EX4650, and QFX5120 devices is affected. Vulnerable releases are 23.4R2-S6 and 24.2R2-S3; later releases (23.4R2-S7, 24.2R2-S4) contain the fix. No other Junos OS versions are reported as vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% shows a low but non‑zero probability of exploitation, while the lack of a CISA KEV listing suggests it is not currently widely known. The unauthenticated network attack vector still allows an attacker with network access to trigger the flaw without logging in or gaining privileged access. This results in a moderate but potentially impactful risk, especially for organizations relying on strict egress filtering on the affected device models.