Junos OS EUVD-2026-101331

Exploitation requires LDP to be running on the device, an LDP session established over a link-protected interface, and the specific triggering condition in which two misconfigured LDP neighbors - or a single neighbor duplicated by an L2 loop - advertise the same transport address. The attacker must have Layer-2/link adjacency (AV:A), not remote network access. The need for this non-default misconfiguration or L2 loop, combined with the adjacency requirement, substantially limits realistic exploitation; impact is confined to denial of service (rpd crash) with no confidentiality or integrity effect. Authentication requirements are not independently confirmed beyond the vendor-supplied PR:N metric.

This is a genuine but conditional availability risk rather than a critical priority. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 7.1 driven entirely by availability impact (VA:H, SA:L) with no confidentiality or integrity impact, consistent with the CWE-617 Reachable Assertion crashing the rpd (routing protocol daemon) process. The adjacent attack vector (AV:A) is a significant real-world limiter: the attacker must be on the same L2/link segment and participate in an established LDP session, not reach the device remotely across the internet. Although the vector lists PR:N, the description makes clear exploitation depends on a specific misconfiguration - two LDP neighbors (or one neighbor duplicated by an L2 loop) advertising the same transport address on a link-protected interface - so this behaves more like a triggerable fault under a non-default/faulty topology than a freely weaponizable flaw. No EPSS score, CISA KEV listing, or public POC is present in the provided data; there is no public exploit identified at time of analysis. The signals are internally consistent (vendor-reported, adjacent, availability-only), so there is no CVSS-versus-description contradiction to flag, but the dependence on a misconfiguration/loop condition means real-world exploitability is narrower than the 7.1 base score alone suggests.

An attacker (or a misconfiguration/L2 loop) with adjacency to a Junos LDP speaker establishes an LDP session over a link-protected interface and causes two neighbors to advertise the same transport address. The resulting condition trips a reachable assertion in rpd, crashing the routing process and denying service. No public exploit code is known, and the attack requires same-segment adjacency plus the specific duplicate-transport-address condition.