EUVD-2026-101433
GHSA-xp4x-7pfr-9746
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish eBGP adjacency with MX router
-
DeliverySend crafted eBGP route update
-
ExploitTrigger reachable assertion in rpd
-
ExecutionRouting daemon crashes
-
ImpactDenial of service on routing plane
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires the router to be running HFRR (hierarchical fast reroute) link protection configured within a VRF/routing instance - a specific, non-default feature combination; devices without this configuration are not affected. The attacker must be positioned to deliver an eBGP route update to the target, implying an established external BGP peering session or adjacency on the peering link (AV:A, PR:N - unauthenticated at the protocol level but requiring peer/adjacency positioning). Limiting factors: adjacent-network vector rather than fully remote Internet reach, dependence on the HFRR-in-VRF configuration, and applicability only to MX Series platforms running the listed vulnerable Junos OS versions. Impact is limited to availability (rpd crash / routing DoS) with no confidentiality or integrity exposure. |
| Impact | This is a genuine but conditional denial-of-service issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H, score 7.1) indicates an adjacent-network, low-complexity, unauthenticated attack with high availability impact and no confidentiality or integrity impact - consistent with a routing-daemon (rpd) crash on Juniper MX Series. The vector's SA:L reflects a limited knock-on availability effect on downstream routing, aligning with the kill of the routing control plane. Critically, exploitation is gated by a non-default configuration (HFRR link protection enabled inside a VRF) and by the attacker needing an eBGP relationship/adjacency to inject the triggering route update, which substantially narrows the exploitable population despite PR:N. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or widespread exploitation - this should be treated as a configuration-dependent reliability/DoS risk to carrier and enterprise edge routers, prioritized for networks that actually run HFRR-in-VRF, not a drop-everything flaw. Note the vector is AV:A (adjacent) rather than fully remote (AV:N); verify whether off-path exploitation is possible, as that would raise urgency. |
| Exploit ScenarioDerived | An attacker who holds an established eBGP peering session (or is adjacent on the peering link) with a Junos MX router that has HFRR link protection configured in a VRF sends a specially crafted BGP route update. The update reaches a reachable assertion in the routing protocol daemon (rpd), causing the daemon to crash and disrupt routing. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
Earlier versions of this analysis (1)
Denial of service in Juniper Networks Junos OS running on MX Series routers, where the routing protocol daemon (rpd) hits a reachable assertion and aborts when it processes a crafted eBGP route update while HFRR link protection is configured inside a VRF. The flaw is remotely triggerable over an adjacent network path by an unauthenticated party that holds an eBGP adjacency to the device (CVSS 3.1 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so the exposure is limited to routers that peer with external BGP speakers and that have the non-default VRF/HFRR configuration enabled. Impact is availability only - no confidentiality or integrity effect - but a successful trigger crashes rpd, causing a routing DoS and potential adjacency churn. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV), although the precondition-dependent nature of the bug means any configured and peering MX router is a candidate target.
RemediationAI
Apply the vendor-released fixes from Juniper advisory JSA112196 (https://supportportal.juniper.net/JSA112196) by upgrading to the first fixed release on the applicable train: 23.2R2-S7.7, 23.4R2-S8.13, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, or 26.2R1-S2 - note that the fix is per-train, so a device must move to the corrected build on its own release line rather than to an arbitrary higher number. If an immediate upgrade is not possible, the most effective compensating control is to remove HFRR link protection from the affected VRF/routing instance, which eliminates the vulnerable code path at the cost of losing fast-reroute link protection for that instance and therefore reducing resilience to transport failures; this should be evaluated against the availability risk it introduces. Additionally, restrict eBGP peering to known and trusted neighbors, apply inbound route filters or maximum-prefix limits on affected sessions, and enable BGP session authentication (TCP-MD5 or TCP-AO) where peering agreements permit - the latter hardens session establishment but does not by itself stop a malformed update from a legitimate peer, since a valid peer that sends a trigger-shaped update would still reach the vulnerable code path. The first sentence of the independent assessment is correct in framing this as a genuine but conditional denial-of-service issue rather than a top-tier emergency: patch on a normal cycle, and treat configuration-level mitigation as a temporary measure while planning the upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-617 (Reachable Assertion): an attacker-influenced eBGP route update drives the Junos routing protocol daemon (rpd) into an unexpected state that trips an internal assertion, causing the daemon to abort rather than continue processing routes. The affected code path is the interaction between BGP route processing and hierarchical fast reroute (HFRR) link protection when that protection is instantiated inside a VRF/routing instance; HFRR normally provides link-level protection for MPLS/RSVP-TE transport, and the assertion appears reachable only in this specific configuration combination, which is not enabled by default. The affected component is identified by CPE cpe:2.3:a:juniper_networks:junos_os, on MX Series hardware. BGP route updates are unauthenticated at the protocol level but must arrive over an established external BGP peering session or adjacency (typically TCP/179), so the practical attack surface is the peering link rather than arbitrary Internet-reachable hosts, consistent with the adjacent-network (AV:A) vector in the assessment. Because the failure is an assertion/abort in rpd, the consequence is protocol-level instability (session resets and routing churn) rather than memory corruption, code execution, or data disclosure.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Attacker needs eBGP adjacency not full remote reach (AV:A), no authentication at protocol level (PR:N), low complexity, and impact is availability-only (A:H) from the rpd crash.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
3DescriptionCVE.org
A Reachable Assertion vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos on MX Series routers allows an unauthenticated network attacker to cause a denial of service via an eBGP route update when HFRR link protection is configured in a VRF.
Executive ViewAI
Juniper MX Series routers running Junos OS with HFRR link protection in a VRF or routing instance are exposed to a routing-level denial of service via crafted eBGP updates from adjacent networks, crashing the routing protocol daemon and disrupting network availability. While no public exploit identified at time of analysis and impact is limited to availability, the potential for extended network downtime affecting business operations makes this a priority for organizations using these routers; patch available per vendor advisory.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB