BGP
Monthly
A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.
A denial of service vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A denial of service vulnerability (CVSS 7.5) that allows an attacker sending a bgp update with a specifically malformed as path. High severity vulnerability requiring prompt remediation.
A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.
Plaintext daemon credentials in IDC SFX2100 routing config files (zebra, bgpd, ospfd, ripd). CVSS 10.0. PoC available.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved lets an adjacent BGP peer crash rpd and cause a denial of service by sending a crafted set of BGP communities. Per the CVSS vector (AV:A/PR:L) the attacker must already sit within the routing trust boundary with an accepted BGP peering session rather than being an arbitrary internet host, and exploitation additionally requires BGP to be configured on the target and the device to add the graceful-shutdown sender community while advertising a route. The impact is availability only (no confidentiality or integrity effect), rated 6.8 (Medium); confirmed actively exploited status is not indicated, and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority availability issue rather than a top-tier emergency.
A denial of service vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.
A denial of service vulnerability (CVSS 7.5) that allows an attacker sending a bgp update with a specifically malformed as path. High severity vulnerability requiring prompt remediation.