EUVD-2026-42723
GHSA-hp6x-whrh-rg9m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Network-reachable gRPC telemetry with only a low-privilege account (PR:L) and no user interaction crashes the FPC for availability-only impact (A:H); no confidentiality or integrity effect.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on EX Series devices allows an authenticated attacker with low privileges to cause a Denial-of-Service (DoS).
If an attempt is made to subscribe to an unsupported telemetry sensor path on EX2300, EX3400, EX4000, EX4100 and EX4400 via gRPC, this causes the FPC to crash. This leads to a complete service outage until the module has automatically restarted.
The following log message can be seen when this issue happens:
agentd[<PID>]: AGENTD_RESOURCE_NOT_FOUND: No resource name found for <sensor>
This issue affects Junos OS on
EX2300, EX3400, EX4000, EX4100 and EX4400
devices:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S5,
- 24.4 versions before 24.4R2.
Articles & Coverage 2
AnalysisAI
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low-privileged authenticated attacker crash the Flexible PIC Concentrator (FPC) by subscribing over gRPC to an unsupported telemetry sensor path in the packet forwarding engine. Each crash produces a complete forwarding outage until the module auto-restarts, and the trigger can be repeated for sustained disruption. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low complexity and single low-privilege prerequisite make it operationally easy to trigger.
Technical ContextAI
The flaw lives in Junos OS's Junos Telemetry Interface (JTI) streaming path, where the agentd process brokers gRPC/gNMI telemetry subscriptions to sensor paths served by the packet forwarding engine (pfe) on EX Series switches. CWE-236 (Improper Handling of Undefined Parameters) captures the root cause: when a client requests a sensor path the platform does not implement, the code fails to gracefully reject the undefined parameter and instead drives the FPC into a crash rather than returning a clean error. The diagnostic signature 'AGENTD_RESOURCE_NOT_FOUND: No resource name found for <sensor>' confirms the request reaches resource resolution before the fault. The CPE cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:* identifies Junos OS as the affected software, though the defect is realized only on the listed fixed-config EX switch models whose FPC runs the vulnerable pfe telemetry handler.
RemediationAI
Vendor-released patch: upgrade Junos OS to a fixed release for the affected EX Series switches - 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S5 or later, or 24.4R2 or later (per Juniper advisory JSA110092, https://supportportal.juniper.net/JSA110092). Until patching is possible, reduce exposure by restricting who can open gRPC telemetry subscriptions: limit management/telemetry-plane access to trusted collector hosts using firewall filters (loopback/lo0 filters) and management-interface ACLs so only authorized JTI collectors can reach the gRPC service, and tighten authorization so low-privilege accounts cannot establish telemetry subscriptions. If Junos Telemetry Interface / gRPC streaming is not in use, disabling the telemetry (gRPC/gNMI) service removes the attack surface entirely; the trade-off is loss of streaming telemetry to monitoring platforms, so coordinate with the NOC before disabling. These controls limit but do not eliminate risk from a trusted-but-compromised collector, so treat them as interim measures pending the upgrade.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Same weakness CWE-236 – Improper Handling of Undefined Parameters
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today