EUVD-2026-101383
GHSA-x6cq-pwfh-62wx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent/directly-connected network position
-
ExploitSend crafted BFD session packets
-
ExecutionTrigger reachable assertion in bfdd
-
ImpactDaemon restarts, disrupting BFD-protected routing
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Requires the bfdd daemon to be active with at least one configured BFD session, and the attacker must be network-adjacent (AV:A) - on the same L2 segment or a directly-connected link participating in or able to inject into a BFD session - so this is not exploitable from arbitrary remote/internet hosts. No authentication and no user interaction are needed (PR:N/UI:N), and default configurations are affected wherever BFD is enabled. Limiting factors: the adjacency requirement sharply narrows the attacker population, impact is confined to denial of service (daemon restart) with no data compromise, and only the listed Junos OS and Junos OS Evolved version trains are affected. |
| Impact | This is a genuine but constrained availability risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) confirms an adjacent, low-complexity, unauthenticated attack with no user interaction, and impact is limited strictly to availability (VA:H, plus SA:L indicating a minor subsequent-system availability effect from the routing-adjacency disruption) - there is no confidentiality or integrity impact (VC:N/VI:N). The CWE-617 Reachable Assertion aligns with the described behavior: crafted BFD traffic drives the bfdd daemon into an assertion that restarts the process, interrupting fault-detection/fast-failover for BGP/OSPF sessions that rely on BFD. Key mitigating signal: AV:A (adjacent) means the attacker must be on the same L2 segment or a directly-connected BFD peer path, not the open internet, which substantially lowers real-world reachability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - treat the 7.1 score as a credible-but-not-urgent priority driven by ease of trigger, tempered by the adjacency requirement and availability-only impact. No signals conflict; the main gap is the absence of EPSS/KEV/POC data, which should not be read as either presence or absence of future risk. |
| Exploit ScenarioDerived | An attacker positioned on a directly-connected link or shared L2 segment with a Junos device running BFD sends malformed BFD session packets that trip a reachable assertion in bfdd, causing the daemon to restart. The restart tears down BFD-protected adjacencies, delaying or disrupting fast failover for routing protocols and degrading network availability; repeated packets can keep the daemon cycling. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-adjacent attacker to trip a reachable assertion in the bfdd daemon and restart it by sending crafted Bidirectional Forwarding Detection (BFD) session traffic. Only devices running an affected release train with BFD configured on at least one session are exposed, and the impact is confined to availability: repeated daemon restarts can disrupt BFD-based link-failure detection and slow routing convergence, but there is no confidentiality or integrity impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and the requirement that the attacker be on the same L2 segment or directly connected link (PR:N, AV:A) sharply limits the attacker population, making this a genuine but constrained availability risk rather than a top-tier emergency.
RemediationAI
Apply the vendor patch: upgrade Junos OS to 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3 or 26.2R1-S2, and Junos OS Evolved to 23.2R2-S7.7-EVO, 23.4R2-S8.11-EVO, 24.2R2-S5.6-EVO, 24.4R2-S5-EVO, 25.2R2-S2-EVO, 25.4R1-S3-EVO or 26.2R1-S2-EVO, per Juniper advisory JSA112187 (https://supportportal.juniper.net/JSA112187); for the affected Junos OS Evolved 23.4X100 listing no fixed release is published in the source data, so consult the advisory for the applicable remediation. Where patching cannot be scheduled immediately, the most effective compensating control is to shrink the exposed attack surface: remove BFD configuration from interfaces that do not require it or disable the bfdd daemon outright, and restrict BFD participation to trusted, physically controlled Layer 2 segments and directly connected links, since exploitation depends on the attacker being adjacency-reachable. The trade-off is the loss of BFD's sub-second link-failure detection, which can slow routing convergence and breach convergence SLAs on links that depend on it, so disabling bfdd is only viable where BFD is not operationally required. Because each malicious packet merely restarts the daemon, monitoring for repeated bfdd restarts or BFD session flaps provides detection, and enabling routing authentication and logging on BFD peers helps surface attempts to inject into a session. No public exploit code has been identified at time of analysis, so remediation can proceed through normal patch cycles rather than an emergency change window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-617 Reachable Assertion in the bfdd daemon, the process that implements Bidirectional Forwarding Detection - a lightweight protocol used to detect link and forwarding-path failures in sub-second time so routing protocols can converge quickly. In Junos OS the daemon runs on the routing engine, and on Junos OS Evolved it runs in the evolved process model; in both cases a crafted BFD control packet drives the daemon into a state where an internal assertion fails, which aborts the process and forces a restart. Because the failure is an assertion-triggered abort rather than a memory-safety violation, there is no path to code execution or data disclosure - the assessed CVSS:3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a purely availability-focused impact with no authentication or user interaction required. The exact affected packages are captured in the CPE entries cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved; exploitation requires that BFD be enabled with at least one configured session and that the attacker be able to inject or participate in that BFD adjacency, which in practice means a directly connected link or shared Layer 2 segment rather than arbitrary internet-facing reach.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/AU:Y/R:A/V:C/RE:M
Adjacent unauthenticated trigger via crafted BFD packets (AV:A/AC:L/PR:N/UI:N); availability-only daemon restart (A:H) with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Reachable Assertion vulnerability in the bfdd daemon of Juniper Networks Junos OS and Junos OS Evolved platforms allows an unauthenticated adjacent attacker to cause a denial of service by restarting the daemon via crafted BFD session traffic.
Executive ViewAI
A denial-of-service flaw in Juniper Networks Junos OS and Junos OS Evolved can force the BFD routing daemon to restart repeatedly, degrading link-failure detection and slowing routing convergence on any device with BFD sessions configured. The attacker must already sit on an adjacent Layer 2 segment or directly connected link and needs no credentials, so exposure is limited to specific network segments rather than the open internet. Leadership should treat this as a contained availability and network-stability risk affecting routing resilience, not a data-breach or integrity event, with remediation driven by Juniper's patched releases.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB