Junos OS EUVD-2026-101375

Exploitation requires the target Junos OS / Junos OS Evolved device to have LLDP 'fast receive processing' enabled - this specific non-default feature state is the explicit trigger named in the description, so devices without it are not exploitable by this vector. The attacker must also be adjacent at Layer 2 (AV:A), meaning direct presence on the same broadcast/link segment as the device; this is not routable across the internet and constrains the realistic threat to LAN-resident or compromised-neighbor attackers. No authentication is required (PR:N) and no user interaction is needed (UI:N). Impact is limited to availability - degradation/disruption of the l2cpd process and the Layer 2 control plane - with no confidentiality or integrity effect.

This is a moderate-priority availability issue, not a critical one. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L, base 7.1) shows an adjacent-network, low-complexity, unauthenticated attack with high availability impact but zero confidentiality or integrity impact - purely a denial-of-service against the l2cpd process. The adjacent (AV:A) vector is a meaningful limiter: the attacker must be on the same Layer 2 segment, which rules out internet-scale remote exploitation and makes this more relevant to attackers with local/LAN footholds or compromised adjacent devices. A further strong limiter is that exploitation requires 'fast receive processing' for LLDP to be enabled, which is a non-default feature state rather than a universally reachable condition. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - this appears to be a vendor-reported (Juniper) issue with a patch already available. Note one data conflict: the input Tags include 'Information Disclosure,' which contradicts the CVSS vector (VC:N/VI:N) and the description - this is clearly a memory-exhaustion/DoS flaw, not information disclosure, and the tag appears mislabeled.

An attacker positioned on the same Layer 2 segment as a vulnerable Juniper device (e.g., via a compromised adjacent host or rogue device on the LAN) sends a stream of crafted LLDP frames to a router/switch that has LLDP fast receive processing enabled. Each frame triggers a memory leak in the l2cpd process, which over time exhausts process memory and disrupts the Layer 2 control plane, degrading or halting L2 protocol operation. No public exploit code has been identified at time of analysis.