Juniper Junos OS multiple NTP vulnerabilities
ANSSI advisory details multiple NTP-related vulnerabilities in Juniper Junos OS and Junos OS Evolved allowing remote code execution, privilege escalation, and denial of service.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 12 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2013-5211 (weaponized); no exploitation in the wild is recorded.
ANSSI (CERT-FR) has republished a Juniper Networks security bulletin (JSA11171) addressing multiple vulnerabilities affecting the NTP implementation bundled in Junos OS and Junos OS Evolved. The flaws, several dating back to 2013-2017 disclosures in the reference NTP daemon, can be leveraged by an attacker to trigger remote denial of service, arbitrary code execution, or privilege escalation depending on the specific CVE and affected code path.
A broad range of Junos OS branches are impacted, spanning versions from 12.3R12 through 19.1R1, as well as Junos OS Evolved releases prior to 20.1R1-EVO. No in-the-wild exploitation is mentioned in the advisory. Juniper has released patched versions for each affected branch; administrators should consult the vendor bulletin and apply the corresponding fixed releases as listed for their deployed version.
This is a routine vendor patch advisory relayed by a national CERT with no indication of active exploitation, and severity should be assessed per-device based on exposure of the NTP service and current Junos version in use.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1124
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs