EUVD-2026-101437
GHSA-245g-hqr8-x69c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach TWAMP-enabled Junos device
-
ExploitCraft specific malicious TCP packet
-
ExecutionTrigger reachable assertion in rmopd
-
ImpactCrash rmopd service (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires the target Junos OS device to be configured with a TWAMP (Two-Way Active Measurement Protocol) client, since the vulnerable code path is in that client - devices without TWAMP configured are not exploitable. When that feature is enabled, no authentication, privileges, or user interaction are needed (PR:N/UI:N): a remote attacker only needs network reachability to the device's TWAMP listener to send the specific crafted TCP packet that triggers the rmopd assertion. The primary limiting factor is therefore this non-default feature configuration rather than any access control; impact is confined to availability (rmopd disruption) with no confidentiality or integrity effect. |
| Impact | Severity signals are moderately strong but impact is narrow. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack requiring no user interaction, scoring 9.2, but the impact metrics confine the damage strictly to availability (VA:H, SA:H) with zero confidentiality or integrity impact (VC:N/VI:N) - consistent with the CWE-617 Reachable Assertion that crashes the rmopd (remote operations management) process. This is a denial-of-service issue, not a code-execution or data-breach issue, so the 9.2 is driven by easy remote reachability rather than by broad consequence. No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. A critical mitigating factor NOT reflected in the base score is that TWAMP is an optional measurement feature that must be explicitly configured; devices without a TWAMP client are not exposed. Net: treat as a real but configuration-dependent availability risk - prioritize patching on devices with TWAMP enabled, lower urgency elsewhere. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to a Junos OS device that has the TWAMP client configured sends a single crafted TCP packet to the device. The packet triggers a reachable assertion in the rmopd service, causing it to crash and disrupting remote operations/measurement functionality. No public proof-of-concept exploit is currently referenced, and the low attack complexity (AC:L) means no special timing or race conditions are required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
Earlier versions of this analysis (1)
Denial of service in Juniper Networks Junos OS allows a crafted TCP packet delivered to the rmopd (real-time performance monitoring) daemon to trip a reachable assertion and disrupt that service. The flaw is network-reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) with availability-only impact, but exploitation requires that the target device have the TWAMP (Two-Way Active Measurement Protocol) client configured, since rmopd only processes the triggering traffic when this monitoring feature is enabled - default deployments without TWAMP/RPM are not exposed. There is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied; Juniper has published advisory JSA112188.
RemediationAI
Apply the vendor fix for this issue: patches are available per Juniper's advisory JSA112188 (https://supportportal.juniper.net/JSA112188), which lists the corrected Junos OS release in each affected train - upgrade to the specified fixed release for the train in use, since no exact fix version is captured in the source data used here and version numbers must not be inferred. Where an immediate upgrade is not feasible, the most effective compensating control is to stop exposing the TWAMP client listener to untrusted networks: remove or temporarily deactivate the TWAMP client configuration (which eliminates the vulnerable code path entirely, at the cost of losing on-box performance-measurement data until the feature is restored), or, if the measurement capability is still needed, front the listener with firewall filters, interface ACLs, or loopback-only binding so that only known, trusted measurement peers can reach the TWAMP control port - this preserves functionality but requires accurate peer inventory and will silently break legitimate measurements if the ACLs are too narrow. Because the trigger is a single TCP packet and no authentication is required, rate-limiting or IDS/IPS signatures against malformed TWAMP control traffic are at best a partial backstop and should not be relied upon in place of patching or access restriction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-617 (Reachable Assertion): the rmopd daemon - the Junos OS component that implements the TWAMP client for on-box performance measurement - fails to validate a field in a specific inbound TCP packet and terminates on an assertion failure instead of handling the malformed input gracefully. TWAMP is the RFC 5357 two-way active measurement protocol used to characterize round-trip delay, jitter, and loss between network devices; the client side initiates control connections to a measurement peer, so the daemon exposes a TCP listener whenever the feature is configured. In CVSS 4.0 terms the vendor vector shows AV:N with PR:N and UI:N, meaning the assertion is reachable from the network without any credential or user action, but the subsequent metrics (VC:N/VI:N/VA:H, SC:N/SI:N/SA:H) confirm the effect is purely a service abort on the targeted device rather than lateral or downstream compromise. The CPE entry cpe:2.3:a:juniper_networks:junos_os:*:*:*:*:*:*:*:* is version-wildcarded, indicating the defect applies across Junos OS releases that include the affected TWAMP client code; the vendor advisory keys the affected and fixed release trains. Because exploitation stops at process termination, there is no memory-corruption, code-execution, or data-disclosure primitive to chain - however, repeated triggering can keep the measurement service down, and loss of rmopd may disrupt monitoring workflows that other automation depends on.
Know when Junos Os gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Remote unauthenticated crafted packet (AV:N/AC:L/PR:N/UI:N) with assertion-driven crash causing availability-only impact (A:H), no confidentiality or integrity effect.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
Lifecycle Timeline
4DescriptionCVE.org
A Reachable Assertion vulnerability in the Two-Way Active Measurement Protocol (TWAMP) client of Juniper Networks Junos OS allows an unauthenticated network-based attacker to cause rmopd service disruption via a specific TCP packet.
Executive ViewAI
Juniper Networks Junos OS devices with the TWAMP client feature enabled are affected by a critical denial-of-service vulnerability that can be triggered remotely without authentication, potentially disrupting network monitoring and management operations. Leadership should prioritize identifying and mitigating exposed devices, as a single crafted packet can crash the rmopd service, though the risk is confined to non-default configurations and no public exploit has been identified at time of analysis.
No vendor-released patch identified at time of analysis. Disable the TWAMP client feature if not required; if required, restrict TCP access to trusted management networks via ACLs or firewall rules; monitor the rmopd service and system logs for crashes; engage Juniper support for interim workarounds; consider out-of-band management for critical devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
OS command injection in the phcd phone-home daemon of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent, u
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-W
Heap-based buffer overflow in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allow
A stack-based buffer overflow in the srxpfe packet forwarding process of Juniper Networks Junos OS on SRX Series devices
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved thro
Remote root code execution in the routing protocol daemon (rpd) of Juniper Junos OS is reachable through protocol-valid
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-bas
Remote code execution with root privileges on Juniper Networks Junos OS and Junos OS Evolved is possible when the routin
Remote code execution and denial of service in Juniper Networks Junos OS and Junos OS Evolved arise from a stack-based b
Unauthenticated remote attackers can gain root-level configuration access and fully compromise Juniper Junos OS and Juno
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is co
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enab
Exploit-DB