EUVD-2026-42713
GHSA-q958-7f7x-pmq4
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Local CLI access and a low-privileged account are required; only availability is impacted via temporary process crash with no confidentiality or integrity effect.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Return of Pointer Value Outside of Expected Range vulnerability in the fileio library of Juniper Networks Junos OS and Junos OS Evolved allows a local, low-privilged attacker to cause a Denial-of-Service (DoS).
On EX Series, QFX Series and MX Series a low-privileged attacker issuing a specific 'show l2-learning' command will cause an l2ald crash which will lead to a temporary service impact for all layer 2 services until the process has automatically restarted.
This issue affects EX Series, QFX Series, MX Series: Junos OS:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S7,
- 24.2 versions before 24.2R2,
- 24.4 versions before 24.4R1-S2.
Junos OS Evolved:
- all versions before 23.2R2-S7-EVO,
- 23.4 versions before 23.4R2-S8-EVO,
- 24.2 versions before 24.2R2-EVO,
- 24.4 versions before 24.4R1-S3-EVO.
AnalysisAI
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a local, low-privileged attacker to crash the l2ald (Layer 2 Address Learning Daemon) by issuing a specific 'show l2-learning' CLI command, disrupting all Layer 2 services until the process automatically restarts. The root cause is a Return of Pointer Value Outside of Expected Range flaw (CWE-466) in the fileio library. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA or the vendor.
Technical ContextAI
The vulnerability resides in the fileio library shared by both Junos OS and Junos OS Evolved, as identified in CPE strings cpe:2.3:a:juniper_networks:junos_os and cpe:2.3:a:juniper_networks:junos_os_evolved. CWE-466 (Return of Pointer Value Outside of Expected Range) indicates that the fileio library returns a pointer that falls outside a valid memory range when processing the 'show l2-learning' command, causing the l2ald process to crash. The l2ald daemon is responsible for managing Layer 2 MAC address learning across interfaces on Juniper EX Series (campus/enterprise switching), QFX Series (data center fabric switching), and MX Series (service provider routing/switching) platforms. Because l2ald handles all L2 learning state, its crash results in a full temporary outage of L2 forwarding services until the process restarts automatically, which Junos OS performs without manual intervention.
RemediationAI
The primary fix is to upgrade to a patched Junos OS release. For Junos OS, upgrade to 23.2R2-S7 or later, 23.4R2-S7 or later, 24.2R2 or later, or 24.4R1-S2 or later depending on the installed train. For Junos OS Evolved, upgrade to 23.2R2-S7-EVO or later, 23.4R2-S8-EVO or later, 24.2R2-EVO or later, or 24.4R1-S3-EVO or later. Full version-specific guidance is available in Juniper advisory JSA110085 at https://supportportal.juniper.net/JSA110085. As a compensating control where patching is not immediately feasible, restrict CLI access to the 'show l2-learning' command family using Junos login class access restrictions - this prevents low-privileged accounts from issuing the triggering command. Trade-off: this reduces operational visibility for NOC staff who rely on L2 learning queries for troubleshooting. Additionally, restrict CLI login to administrative accounts only via RADIUS/TACACS+ authorization policies to reduce the pool of potential actors who could trigger this command.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today