Junos OS EUVD-2026-42713

Exploitation requires local CLI access to the affected Juniper device (AV:L confirmed by CVSS vector), which in practice means SSH, console, or out-of-band management access. The attacker must hold at least a low-privileged Junos account (PR:L from CVSS vector) - a fully unauthenticated attacker cannot trigger this. The specific trigger is issuing a particular 'show l2-learning' command variant, meaning the attacker must have permission to execute operational show commands in their login class. Exploitation is limited to EX Series, QFX Series, and MX Series hardware; other Juniper platforms are not listed as affected. The impact is bounded by the auto-restart behavior of l2ald, limiting the outage to a temporary window. Exploitation does not require user interaction from another party and involves no scope change beyond the local device.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects the constrained attack surface: AV:L requires the attacker to have local CLI access to the device, and PR:L requires at least a low-privileged account - meaning unauthenticated remote exploitation is not possible. The availability impact is rated High (A:H) because all Layer 2 services are disrupted on crash, which in a production switching or routing environment could cause significant service degradation. However, the impact is temporary since l2ald auto-restarts. No EPSS data was provided in the source intelligence; without that signal, exploitation probability cannot be quantified numerically. The absence of a KEV listing and any reported POC further supports that this is not currently under active exploitation. Real-world priority is moderate: organizations where low-privileged users have CLI access to core Junos devices (e.g., read-only NOC accounts, shared jump-host environments) face a credible insider or post-compromise DoS risk. Organizations that strictly enforce least privilege and limit CLI access to administrators face substantially lower risk.

An attacker with a low-privileged Junos CLI account - for example, a read-only NOC operator account or a compromised service account - logs into an affected EX, QFX, or MX device via SSH and issues a specific 'show l2-learning' command. This triggers the pointer out-of-range condition in the fileio library, crashing l2ald and dropping all Layer 2 forwarding state on the device until the process restarts, potentially causing network outages for downstream users. No public proof-of-concept code has been identified at time of analysis, but the attack vector is straightforward once CLI access is obtained.