EUVD-2026-42723
GHSA-hp6x-whrh-rg9m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Network-reachable gRPC telemetry with only a low-privilege account (PR:L) and no user interaction crashes the FPC for availability-only impact (A:H); no confidentiality or integrity effect.
Primary rating from Vendor (juniper).
CVSS VectorVendor: juniper
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:X/RE:M/U:X
Lifecycle Timeline
4DescriptionCVE.org
An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on EX Series devices allows an authenticated attacker with low privileges to cause a Denial-of-Service (DoS).
If an attempt is made to subscribe to an unsupported telemetry sensor path on EX2300, EX3400, EX4000, EX4100 and EX4400 via gRPC, this causes the FPC to crash. This leads to a complete service outage until the module has automatically restarted.
The following log message can be seen when this issue happens:
agentd[<PID>]: AGENTD_RESOURCE_NOT_FOUND: No resource name found for <sensor>
This issue affects Junos OS on
EX2300, EX3400, EX4000, EX4100 and EX4400
devices:
- all versions before 23.2R2-S7,
- 23.4 versions before 23.4R2-S8,
- 24.2 versions before 24.2R2-S5,
- 24.4 versions before 24.4R2.
Articles & Coverage 2
AnalysisAI
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low-privileged authenticated attacker crash the Flexible PIC Concentrator (FPC) by subscribing over gRPC to an unsupported telemetry sensor path in the packet forwarding engine. Each crash produces a complete forwarding outage until the module auto-restarts, and the trigger can be repeated for sustained disruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target be an EX2300, EX3400, EX4000, EX4100 or EX4400 running an affected Junos OS release with the Junos Telemetry Interface / gRPC (gNMI) streaming service reachable, and the attacker must hold a low-privilege authenticated account able to open a gRPC telemetry subscription (CVSS PR:L confirms authentication is needed; not exploitable unauthenticated). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 7.1 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and impact confined to availability (VA:H, SA:L; VC:N/VI:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privilege authenticated foothold on the switch's management plane - or on a monitoring host permitted to reach the gRPC endpoint - opens a telemetry subscription to a sensor path that the EX platform does not support. The malformed/undefined path resolution crashes the FPC and drops the switch's forwarding for the duration of the auto-restart, and the attacker scripts repeated subscriptions to keep the device offline. … |
| Remediation | Vendor-released patch: upgrade Junos OS to a fixed release for the affected EX Series switches - 23.2R2-S7 or later, 23.4R2-S8 or later, 24.2R2-S5 or later, or 24.4R2 or later (per Juniper advisory JSA110092, https://supportportal.juniper.net/JSA110092). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all affected EX Series switch models (EX2300, EX3400, EX4000, EX4100, EX4400) in production; restrict gRPC telemetry endpoint access via administrative ACLs and firewall rules to authorized management networks only; disable non-essential telemetry subscriptions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthen
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls l
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exh
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker t
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2)
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauth
Out-of-bounds write in the Juniper Networks Junos OS http-gatekeeper (http-gk) process on SRX Series firewalls crashes t
Repeated IKE negotiation failures on Juniper Junos OS (MX with SPC3 and SRX Series) cause a peer index rollover that ass
Web filtering bypass on Juniper Networks Junos OS MX Series exposes downstream resources to unauthenticated network atta
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved on EX Series, QFX Series, and MX Series allows a loc
Junos OS on Juniper EX Series access switches exposes a missing authorization flaw in the CLI that allows any locally au
Same weakness CWE-236 – Improper Handling of Undefined Parameters
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today