Massive vulnerability found: Juniper Networks RCE bug affects countless devices

TLDR: More than 11,500 Juniper Networks devices are vulnerable to a remote code execution (RCE) bug, prompting researchers to urge admins to apply patches. The vulnerability, CVE-2024-21591, affects the J-Web configuration interface and carries a severity score of 9.8. An attacker can exploit the out-of-bounds write flaw to achieve various goals without authentication. Notably, out-of-bounds write vulnerabilities are a major cause of security issues. Patches have been released to address the vulnerability, and Juniper Networks advises either applying the patches or disabling J-Web or limiting access to trusted hosts. The disclosure comes after the US Cybersecurity and Infrastructure Security issued an operational directive about the dangers of exposing management interfaces to the public web.