CVE-2018-0007

An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able…

published January 10, 2018

CVSS
—
EPSS
2%
Percentile
82.5
In the wild
Unconfirmed
What it is

⚠️ A crafty attacker can send a specially crafted LLDP packet to your Junos devices and trigger a memory corruption that leads to a denial of service! Think of it like a sneaky delivery person who drops a fake package on your doorstep, causing everyone in the neighborhood to freak out and lose power—this is how a bad LLDP packet can plunge your network into chaos! If exploited, this vulnerability could cause your Junos devices to become unresponsive, leading to downtime and potential loss of service. But it gets even worse! An authenticated attacker could ride this wave of confusion to elevate their privileges, giving them control over your devices in a mind-blowingly simple maneuver!

Put simply

Think of it like a sneaky delivery person who drops a fake package on your doorstep, causing everyone in the neighborhood to freak out and lose power—this is how a bad LLDP packet can plunge your network into chaos! This vulnerability arises when an unauthenticated attacker sends a malicious LLDP packet that causes improper boundary checks, leading to memory corruption and denial of service. If the attacker is authenticated, they can perform command or arbitrary code injection, taking control of the targeted devices.

What to do

If exploited, this vulnerability could cause your Junos devices to become unresponsive, leading to downtime and potential loss of service. But it gets even worse! An authenticated attacker could ride this wave of confusion to elevate their privileges, giving them control over your devices in a mind-blowingly simple maneuver! Update all affected Junos OS versions to the latest (12.1X46-D71, 12.3R12-S7, 14.1R8-S5, etc.) to mitigate this issue. Ensure network configurations are secure and monitor for unusual LLDP traffic. Don't wait—patch now! You've got this! Take these steps, and you’ll keep your network fortress strong! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02218 · 82.5th percentile
Published
2018-01-10T22:00Z
EPSS history
Timeline
  • 10 JAN 22:00Z
    An unauthenticated network-based attacker able to send a maliciously crafted LLDP packet to the local segment, through a local segment broadcast, may be able…
    cvelistv5