An Improper Check for Unusual or Exceptional Conditions flaw (CWE‑754) in Juniper Networks Junos OS on MX Series routers allows adjacent subscribers that are defined on static interfaces to bypass all ingress firewall filters and bandwidth limits. Because the packet forwarding engine does not enforce the configured filters for static subscriber interfaces, attacker‑controlled traffic can enter or leave the router without inspection or rate control, exposing critical internal traffic to potential integrity and confidentiality compromise.

The affected products are Juniper Networks Junos OS running on MX Series routers, including the MPC10, MPC11, LC4800, LC9600, LC4802, and MX304 models. Vulnerable firmware versions are: 23.2R2‑S1 through 23.2R2‑S6, all 23.4R2 builds prior to 23.4R2‑S7, all 24.2 releases before 24.2R2‑S3, all 24.4 releases before 24.4R2‑S2, and all 25.2 releases older than 25.2R2.

The CVSS base score of 5.3 indicates moderate severity, while an EPSS score of less than 1 % suggests that exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers would need physical or near‑physical proximity to a subscriber interface configured with a static address on the same MX device; remote exploitation through the public Internet is not supported. Once bypassed, the flaw allows malicious or unmonitored traffic to flow through the router, potentially compromising the confidentiality or integrity of downstream traffic.