EUVD-2026-21092
GHSA-xh4h-63x5-gr2f
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An Improper Check for Unusual or Exceptional Conditions vulnerability in the chassis control daemon (chassisd) of Juniper Networks Junos OS on SRX1600, SRX2300 and SRX4300 allows a local attacker with low privileges to cause a complete Denial of Service (DoS).
When a specific 'show chassis' CLI command is executed, chassisd crashes and restarts which causes a momentary impact to all traffic until all modules are online again.
This issue affects Junos OS on SRX1600, SRX2300 and SRX4300:
- 24.4 versions before 24.4R1-S3, 24.4R2.
This issue does not affect Junos OS versions before 24.4R1.
AnalysisAI
Denial of service in Juniper Junos OS chassis control daemon (chassisd) on SRX1600, SRX2300, and SRX4300 devices allows local attackers with low privileges to trigger a complete crash via a specific 'show chassis' CLI command, causing temporary traffic disruption until module recovery. Junos OS 24.4 versions before 24.4R1-S3 and 24.4R2 are affected; no public exploit code identified at time of analysis.
Technical ContextAI
The vulnerability exists in chassisd, a critical system daemon responsible for chassis management and hardware control on Juniper SRX Series security appliances. The root cause is CWE-754 (Improper Check for Unusual or Exceptional Conditions), meaning chassisd fails to properly validate or handle edge case inputs when processing the 'show chassis' CLI command, leading to an unhandled exception or memory corruption. The affected SRX models (SRX1600, SRX2300, SRX4300) are modular security gateways where chassisd orchestrates multiple control and data plane modules; when it crashes, the entire control plane becomes unavailable until daemon restart completes and all modules synchronize, causing temporary loss of traffic forwarding and management access.
RemediationAI
Upgrade affected SRX devices to Junos OS 24.4R1-S3 or later (24.4R2 or newer in the 24.4 branch) to resolve the chassisd exception handling flaw. Juniper advisory JSA107810 at https://kb.juniper.net/JSA107810 provides detailed patched version numbers and upgrade procedures. As an interim mitigation prior to patching, restrict CLI access to the 'show chassis' command to authorized administrators only and monitor for unexpected chassisd restarts via syslog monitoring of MGD or chassis daemon events. No operational workaround completely eliminates the vulnerability; patching is the primary remediation.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users t
Privilege escalation in Juniper Networks Junos OS allows high-privileged local attackers to gain root access on Linux-ba
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to in
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today