EUVD-2026-101372
GHSA-cfqf-pw39-4rx2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent Layer 2 access
-
DeliverySend crafted traffic to FNP interface
-
ExploitExhaust l2cpd resources (CWE-770)
-
ExecutionTrigger l2cpd crash and restart
-
ImpactLayer 2 control-plane denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the FNP feature to be enabled on a VPLS routing instance that also has VLAN-VPLS encapsulation configured - this is a specific, non-default deployment and is the key limiting factor. The attacker must additionally be on an adjacent Layer 2 network segment reachable via an FNP-enabled Layer 2 interface (AV:A), so remote internet-based exploitation is not possible. No authentication is required (PR:N) and no user interaction is needed (UI:N). The vulnerability affects all Junos OS platforms EXCEPT the PTX Series and SRX Series; devices not running the FNP/VPLS/VLAN-VPLS combination are not exposed regardless of version. |
| Impact | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) describes an adjacent-network, low-complexity, unauthenticated attack requiring no user interaction, with impact limited to availability (VA:H, SA:L) - consistent with the description of an l2cpd process crash and restart (CWE-770, resource exhaustion). This is a denial-of-service issue only: there is no confidentiality or integrity impact (VC:N/VI:N). The 7.1 score is driven entirely by the availability hit, not by code execution or data exposure. Crucially, exploitation is gated by a non-default configuration (FNP feature enabled on a VPLS routing instance using VLAN-VPLS encapsulation) and by adjacency (AV:A) - an attacker must be on the same Layer 2 segment, not the open internet. No EPSS score was provided in the input, so exploitation probability cannot be quantified; this is a data gap. There is no CISA KEV listing and no public exploit referenced, so this is not confirmed as actively exploited. Net assessment: a legitimate priority for operators running the specific vulnerable VPLS/VLAN-VPLS configuration on affected Junos platforms, but a moderate real-world risk overall given the adjacency requirement, non-default feature prerequisite, and availability-only impact - not a drop-everything critical. |
| Exploit ScenarioDerived | An attacker with access to an adjacent Layer 2 segment (e.g. a compromised host or rogue device on a connected VLAN) sends crafted traffic to an FNP-enabled Layer 2 interface on a Junos OS device configured for VPLS with VLAN-VPLS encapsulation. The malformed or excessive input exhausts resources in the l2cpd process, causing it to crash and restart, disrupting Layer 2 control-plane functions. No public exploit identified at time of analysis, and no authentication or user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Juniper Networks Junos OS allows an attacker on an adjacent Layer 2 network segment to exhaust resources in the l2cpd (Layer 2 Control Protocol) process, causing the daemon to restart and disrupting Layer 2 control-plane services on the affected device. The attack is unauthenticated and requires no user interaction, but is only reachable when the FNP feature is enabled on a VPLS routing instance that also has VLAN-VPLS encapsulation configured - a specific, non-default deployment that limits exposure; remote internet-based exploitation is not possible. All Junos OS platforms are potentially affected except the PTX Series and SRX Series, and no public exploit code or confirmed active exploitation was identified at time of analysis (the issue is not listed in CISA KEV), though a vendor patch is available.
RemediationAI
Apply the Juniper vendor patch by upgrading to a fixed Junos OS release: 23.2R2-S7.7 or later on the 23.2 branch, 23.4R2-S8.13 or later on 23.4, 24.2R2-S5.5 or later on 24.2, 24.4R2-S5 or later on 24.4, 25.2R2-S2 or later on 25.2, 25.4R1-S3 or later on 25.4, and 26.2R1-S2 or later on 26.2; full guidance is in the vendor advisory at https://supportportal.juniper.net/JSA112188. Where an immediate upgrade is not feasible, the most effective compensating control is to remove the vulnerable configuration combination - disable FNP on any VPLS routing instance that uses VLAN-VPLS encapsulation, or remove VLAN-VPLS encapsulation from FNP-enabled VPLS instances - accepting that this disables the FNP-based forwarding behavior and may change Layer 2 service characteristics for customers on that instance. Because the attack vector is strictly adjacent (AV:A), segmenting and filtering Layer 2 adjacency so that untrusted hosts cannot reach FNP-enabled interfaces, for example by enforcing port security, restricting trunk/access port membership, or isolating the VPLS-facing segment behind controlled bridging domains, reduces reachability but does not eliminate the bug and should be treated as a stopgap rather than a fix. Monitor and alert on l2cpd process restarts and related Layer 2 control-protocol flaps as an indicator that either the vulnerability is being triggered or the configuration is unstable. Note that rate-limiting Layer 2 control traffic broadly can degrade legitimate protocol convergence, so any filtering should be scoped to the specific interfaces and VLANs that carry the FNP/VPLS/VLAN-VPLS deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-770 (Allocation of Resources Without Limits or Throttling) in l2cpd, the Junos OS daemon responsible for Layer 2 control protocols. When FNP is enabled on a VPLS (Virtual Private LAN Service) routing instance that uses VLAN-VPLS encapsulation, certain Layer 2 traffic arriving on FNP-enabled interfaces causes the process to allocate resources without adequate bounds or rate limiting, culminating in resource exhaustion and an l2cpd restart. VPLS provides multipoint Layer 2 VPN emulation and VLAN-VPLS encapsulation maps customer VLAN tags into the VPLS forwarding domain, so the affected configuration sits at the intersection of an FNP-enabled forwarding path and a bridged Ethernet service - a combination that is deliberately configured rather than enabled by default. The CPE data (cpe:2.3:a:juniper_networks:junos_os) confirms this is a Junos OS platform-level defect rather than a third-party component issue, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N, VA:H/SA:L) and the independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) both describe an availability-only impact, consistent with a daemon crash-and-restart rather than memory corruption or code execution. The absence of confidentiality and integrity impact, combined with the adjacent-network attack vector, means the bug cannot be used to read data, modify configuration, or pivot to remote code execution on its own.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent unauthenticated trigger with no interaction (AV:A/PR:N/UI:N); impact is an l2cpd crash/restart so A:H with no confidentiality or integrity effect.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
An Allocation of Resources Without Limits or Throttling vulnerability in the l2cpd process of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a denial of service and l2cpd restart via FNP-enabled Layer 2 interfaces. The issue is triggered when the FNP feature is enabled on a VPLS routing instance with VLAN-VPLS encapsulation enabled.
This issue affects all platforms except the PTX Series and SRX Series.
Executive ViewAI
A high-severity denial-of-service flaw in Juniper Networks Junos OS can cause the l2cpd Layer 2 control protocol daemon to restart, interrupting Layer 2 control-plane services on affected carrier and enterprise edge platforms. Exposure is narrow: the risk applies only where the FNP feature is enabled on a VPLS routing instance configured with VLAN-VPLS encapsulation, and PTX and SRX Series platforms are unaffected. Leadership should care because unplanned control-plane restarts on service-provider or aggregation infrastructure can degrade customer-facing connectivity, though no public exploit or active exploitation was identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB