Juniper Networks
Monthly
A reachable-assertion flaw in the Juniper Junos OS and Junos OS Evolved rpd routing daemon lets a network-adjacent attacker crash the daemon by sending a crafted LDP Label message that carries an IPv6 Prefix FEC, producing a denial-of-service condition (CVSS 4.0 base 7.1; availability-only). The attacker must already share an L2 segment or act as a directly connected routing peer and must have an established LDP session with the target, so only devices with LDP configured and actively exchanging IPv6 Prefix FEC bindings are exposed; no authentication or user interaction is required once that adjacency exists (PR:N, UI:N), and the daemon's automatic restart bounds each outage. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); impact is limited to availability, with no confidentiality or integrity effect.
Juniper Junos OS and Junos OS Evolved devices that run OSPFv3 on a broadcast interface can be crashed by an unauthenticated adjacent attacker who sends specially crafted OSPFv3 protocol messages to the rpd routing daemon, producing a denial of service and heap memory corruption. Exploitation requires only Layer-2 adjacency to the affected broadcast segment and no credentials or user interaction, but devices that do not run OSPFv3, or that use point-to-point interface types, are not exposed; no public exploit code has been identified at time of analysis. Vendor severity is moderate (CVSS 4.0 7.1) with an availability-only impact, aligning with our independent CVSS 3.1 assessment of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
Malformed PIM Hello messages can crash the rpd process in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on IPv6-enabled PIM interfaces. This improper input validation flaw (CWE-20) is exploitable by an unauthenticated adjacent attacker (AV:A) without user interaction, but requires PIM to be configured and the target interface to be IPv6-enabled. No public exploit code or active exploitation is known; the CVSS 4.0 base score is 7.1, and independent assessment classifies this as a moderate-severity availability issue with a bounded exposed population.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker who already holds an established EVPN BGP peering relationship with a target device to disrupt the routing protocol daemon (rpd) by sending EVPN BGP routes that trigger an integer overflow or wraparound. The flaw affects EVPN-enabled routing instances and can tear down control-plane adjacencies and halt route processing, producing an availability-only impact with no confidentiality or integrity effect. EVPN is a deliberately configured, non-default feature and the peering trust relationship must pre-exist, so realistic exploitation is limited to EVPN deployments and adjacent or compromised BGP peers; no public exploit code was identified at time of analysis, and the vendor advisory is Juniper JSA112187.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, peer-trusted attacker to crash the routing protocol daemon (rpd) by sending specially crafted EVPN route updates. Exploitation requires an established, accepted EVPN BGP peering session with the attacker controlling or compromising the peer endpoint; routers without EVPN/BGP signaling configured or without the attacker in their accepted-peer set are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis; risk is limited to availability (no confidentiality or integrity impact), but the flaw is a genuine operational priority for networks running EVPN.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-positioned attacker to disrupt the routing protocol daemon (rpd) by delivering a crafted BGP EVPN update message. Affected releases include multiple Junos OS and Junos OS Evolved versions, but exposure requires that BGP with the EVPN address family be configured - a non-default setting typical of EVPN-VXLAN data center fabrics - and the attacker must be able to reach rpd over an established BGP EVPN session (a configured peer or an on-path attacker on the peering path). Impact is availability-only (control-plane DoS) with no confidentiality or integrity exposure; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered in the routing protocol daemon (rpd) by a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. The vendor rates this 8.7, while independent assessment maps it to high availability impact (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the practical precondition is an established EVPN peering relationship, so an arbitrary internet host is not sufficient despite the unauthenticated CVSS vector. No public exploit code or CISA KEV active exploitation is identified in the provided data at time of analysis, and affected deployments are those running EVPN on unpatched Junos OS or Junos OS Evolved releases.
Denial of service in Juniper Junos OS and Junos OS Evolved rpd allows a configured BGP neighbor to crash the routing protocol daemon by sending a crafted BGP route update when both resolution-map routing policy and policy event-tracing are enabled. The flaw is a NULL pointer dereference (CWE-476) affecting multiple release trains; exploitation requires the non-default combination of those two features and an existing BGP peering relationship, so baseline or non-peered devices are not exposed. Juniper has released patches via advisory JSA112187, and no public exploit identified at time of analysis.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated, already-configured BGP peer crash the routing process by sending a crafted BGP UPDATE, producing a denial of service, but only on devices where both ISO-VPN and egress-protection are enabled - a non-default feature combination. The CVSS 4.0 vector scores 8.7 (High) and is driven entirely by availability impact (VC:N/VI:N/VA:H/SC:N/SI:N/SA:L), with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation were identified at time of analysis; arbitrary Internet hosts cannot reach the vulnerable code path because the sender must already be an operator-configured BGP peer of the target device.
A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.
An integer underflow in the srxpfe forwarding-plane daemon of Junos OS and Junos OS Evolved on SRX Series firewalls allows an unauthenticated attacker on an adjacent network segment to trigger a denial of service by sending an ICMP message tied to an SVR (Secure Vector Routing) carrier session. Affected deployments are those running SVR/carrier-session functionality on SRX platforms, where successful exploitation degrades or halts packet forwarding; the CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss (assessed CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis, but the attack requires only Layer 2 adjacency and no credentials or user interaction, so any SRX device with SVR sessions reachable from an untrusted adjacent segment should be treated as exposed.
Denial of service in Juniper Networks SRX Series firewalls running Junos OS in a chassis-cluster (high-availability) configuration allows an adjacent attacker to crash the data plane by sending crafted traffic over the chassis-cluster fabric interconnect. The flaw is a signed-to-unsigned conversion error (CWE-195) in the srxpfe packet forwarding engine; authentication requirements are confirmed as unauthenticated (PR:N) and no user interaction is needed (UI:N) once the attacker has a position on the fabric. There is no public exploit identified at time of analysis and no record of confirmed active exploitation (CISA KEV), and the attack surface is restricted to clustered deployments rather than general network exposure, making this an access-constrained availability threat.
Malformed firewall-authentication synchronization traffic delivered over a chassis-cluster fabric link can trip a reachable assertion in the srxpfe process on Juniper Networks SRX Series devices running Junos OS, aborting the packet forwarding engine and causing a denial of service of the data plane for traffic traversing the cluster. Exposure is limited to SRX platforms deployed in chassis-cluster high-availability configurations where firewall-authentication synchronization is in use; standalone SRX devices and clusters that do not use that synchronization mechanism are unaffected, and the attacker must already have a position on the normally dedicated point-to-point fabric interconnect (logically adjacent, with no authentication or user interaction required per the assessed vectors). At the time of analysis no public exploit code and no confirmed active exploitation were identified; the CVSS 4.0 base score is 7.1 with availability-only impact (VC:N/VI:N/VA:H), and the vendor advisory is Juniper JSA112186.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to crash or destabilize the routing daemon (rpd) by sending a specially crafted IS-IS SRv6 packet, disrupting routing on the affected device. Exploitation is tightly constrained: the device must have both SRv6 and Flexible Algorithm explicitly enabled in its IS-IS configuration (a non-default segment-routing setup), and the attacker must already sit on an adjacent network segment able to inject IS-IS packets into the routing domain - a remote Internet attacker cannot reach this path. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with an assessed CVSS:3.1 base of AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (vendor score 7.1 under CVSS 4.0), it is a moderate-priority, availability-only issue whose real-world exposure is narrowed by its configuration prerequisites and adjacency requirement.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.
A malformed BGP VPLS signaling update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on the affected device. The flaw is improper input validation (CWE-20) in rpd's handling of BGP signaling messages; the attack vector is adjacent and the CVSS 4.0 vector carries PR:N (no privileges required), but successful exploitation requires the target to be running BGP with VPLS signaling configured and to already have an established peering relationship with the attacking peer. Impact is limited to availability (rpd restart, routing churn, potential traffic loss) with no confidentiality or integrity impact; no public exploit code has been identified and there is no KEV confirmation of active exploitation at time of analysis, so this is a genuine but bounded operational risk rather than an urgent emergency.
An adjacent eBGP peer can crash the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted VPLS signaling update, but only on routers where VPLS automatic site-ID negotiation is enabled and an external BGP peering session is already established. The flaw is a reachable assertion (CWE-617) in rpd that terminates the process, producing a denial of service with no confidentiality or integrity impact; Juniper rates it 7.1 under CVSS 4.0, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, treating it as a moderate-priority availability issue rather than an emergency. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so risk is concentrated in networks that combine external BGP peering with non-default VPLS auto site-ID negotiation.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG with ICCP can be disrupted by an adjacent, unauthenticated attacker who sends an inconsistent ICCP peer message that triggers a reachable assertion in the l2ald daemon. Successful exploitation results in a denial of service affecting availability, with no confidentiality or integrity impact; no public exploit was identified at time of analysis, and the attack is limited to environments that have the non-default MC-LAG/ICCP redundancy feature enabled and where the attacker can reach the ICCP peer relationship at Layer 2.
Crashing the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is possible via a malformed BGP MCAST-VPN update sent from a configured eBGP peer, resulting in a denial-of-service condition. Exploitation is gated: the target must have the BGP multicast-VPN (MVPN) address family active and an established eBGP peering relationship, so realistic attackers are limited to peering or adjacent networks rather than the general internet. No public exploit code or confirmed active exploitation exists at time of analysis, and the vendor advisory (JSA112187) should be consulted for patch availability.
Denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to disrupt or crash RSVP processing by sending a malformed RSVP packet to an interface where RSVP is explicitly enabled. Exploitation is conditional: RSVP is not enabled by default and is only present in MPLS traffic-engineering/signaling deployments, and the attacker must have Layer-2 or directly-reachable adjacency to the affected interface (CVSS AV:A, PR:N, UI:N), so routers without RSVP configured are not exposed. Impact is availability-only with no confidentiality or integrity exposure; vendor CVSS is 7.1, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
OS command injection in the Junos OS CLI lets an authenticated, low-privileged local user escalate to full root control of the device by passing unsanitized arguments to the 'request csds' operational command. Only Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3) are affected; releases before 24.4R1 are explicitly unaffected, and the attack is strictly local with no network or unauthenticated path. There is no public exploit identified at time of analysis, and Juniper has released fixed versions (24.4R2-S4, 25.2R2-S1, 25.4R1-S3), making this a serious but access-gated issue rather than an internet-facing emergency.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
A malformed BGP-signaled SRv6 service route can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service that disrupts routing on the affected device. The issue is remotely triggerable with no credentials or user interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, VA:H), scoring 8.7, but it is conditional: exploitation requires that SRv6 dynamic tunnels be explicitly enabled (a non-default configuration) and that the attacker already hold an established BGP peering session with the target. Impact is limited to availability of the routing daemon - there is no confidentiality or integrity impact - and no public exploit has been identified at time of analysis. All software versions enumerated by the vendor are unpatched; Juniper has released fixed builds.
Malformed OSPF packets crafted by an adjacent OSPF peer can crash the Juniper Networks Junos OS rpd routing daemon or disclose portions of its process memory, affecting both Junos OS and Junos OS Evolved builds below the fixed releases enumerated in JSA112187 (for example Junos OS prior to 23.2R2-S7.7, 24.2R2-S5.5 and 25.2R2-S2, and the corresponding -EVO builds). The weakness is an unauthenticated adjacent attack (CVSS v4.0 base 7.1, AV:A/PR:N/UI:N with high availability and low confidentiality impact), meaning the attacker must already hold or establish OSPF adjacency on the same routing segment, so exposure is confined to devices actively running OSPF rather than the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are already available, making this a moderate-priority routing-infrastructure issue rather than a mass-exploitation emergency.
Crafted RSVP packets can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on devices where non-default Layer 2 label-switched path (L2 LSP) RSVP signaling is enabled. The issue is an adjacent-network, unauthenticated attack (CVSS v4.0 7.1, AV:A/AC:L/PR:N/UI:N, availability-only impact, and our independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/A:H): the attacker must sit on the same Layer 2 segment as the target but needs no credentials and no user interaction, and a single malformed packet is sufficient. No public exploit code exists and there is no confirmed active exploitation at time of analysis, and the practical exposure is bounded because L2 LSP support is a non-default configuration; Juniper advisory JSA112187 provides patched releases.
A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
An authenticated format-string vulnerability in the gRPC daemon that backs the gNMI service on Juniper Networks Junos OS Evolved lets a network attacker who holds valid low-privileged credentials feed crafted format specifiers into a telemetry code path, with potential outcomes ranging from telemetry-service disruption and information disclosure up to root-level code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is remote but requires an authenticated session against an enabled, network-reachable gNMI interface - it is not reachable by a fully anonymous attacker. At the time of analysis there is no CISA KEV entry and no public exploit code identified, and the vendor has published advisory JSA112250; this is a credible priority for organizations running Evolved with gNMI exposure, but not a drop-everything emergency on the available signals.
Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon allows adjacent attackers on the management LAN to execute arbitrary commands as root via a crafted DHCP response. The vulnerability has a CVSS 4.0 base score of 9.3 and requires the target device to be actively in ZTP mode; no public exploit code is identified at time of analysis.
A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.
Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evolved on PTX Series routers allows an attacker positioned on the management LAN to execute arbitrary commands as root by sending a crafted gRPC response to a device that is actively provisioning. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting low attack complexity, no authentication or user interaction requirements, and full confidentiality, integrity, and availability impact; the adjacent-network attack vector (AV:A) means the device is not exploitable directly from the internet. No public exploit code has been identified at time of analysis, no CISA KEV listing or EPSS score was provided, and exposure is materially reduced where management traffic runs over a segmented or physically isolated out-of-band network and where devices are not in an active ZTP state.
Unauthenticated adjacent IS-IS peers can cause a denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series by sending crafted input that fails proper quantity validation (CWE-1284). This medium-severity flaw (CVSS 6.5, AV:A/PR:N/UI:N/A:H) requires the attacker to hold Layer 2 adjacency on a directly connected or shared broadcast segment; no authentication or user interaction is needed. No public exploit code has been identified at time of analysis.
Persistent telemetry dial-out denial of service in Juniper Networks Junos OS Evolved allows an attacker with management-plane access to the device's gNMI listener to crash or wedge the jti-dialoutd telemetry process by submitting a crafted analytics sensor resource that is consumed as a format string (CWE-134). Exploitation requires the gNMI listener to be reachable and enabled with telemetry/JTI dial-out configured, and Juniper's description characterizes the actor as authenticated; note that the published CVSS vector lists PR:N, which contradicts that authentication prerequisite and should be reconciled against Juniper advisory JSA112250. Impact is confined to loss of telemetry dial-out and analytics streaming rather than data-plane forwarding, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low-privileged authenticated attacker crash the Flexible PIC Concentrator (FPC) by subscribing over gRPC to an unsupported telemetry sensor path in the packet forwarding engine. Each crash produces a complete forwarding outage until the module auto-restarts, and the trigger can be repeated for sustained disruption. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low complexity and single low-privilege prerequisite make it operationally easy to trigger.
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exhaust the packet forwarding engine (PFE) by exploiting a race condition in stateful flow teardown. When the race is hit, a flow's timeout is mis-set to a very high value (>10,000s instead of 3s), so sessions are never reaped, invalidated sessions accumulate without bound, and the device eventually stops forwarding or hits a flowd core and reboots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is probabilistic because the triggering conditions are outside the attacker's control.
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker to exhaust packet-forwarding-engine memory and crash the Flexible PIC Concentrator (FPC). The flaw triggers only when sFlow monitoring is enabled in a Virtual Chassis and multicast traffic ingresses on one VC member and egresses on another, causing a slow buffer leak that culminates in an FPC crash and restart. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability risk for affected deployments.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated, network-based attacker to crash the flow processing daemon (flowd) by sending a malformed SIP INVITE packet when the SIP Application Layer Gateway (ALG) is enabled. The crash forces a flowd restart, producing a complete traffic-forwarding outage until the device auto-recovers, and can be repeated to sustain the outage. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. Because TCP proxy is engaged whenever ALGs, Advanced Anti-Malware, ICAP, or UTM services inspect a flow, exploitation forces a complete traffic-forwarding outage until the daemon auto-restarts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat to perimeter devices.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls lets an unauthenticated, network-based attacker crash and restart the PFE, dropping all traffic-forwarding services until automatic recovery. Exploitation is indirect: the attacker must lure or wait for the affected device to initiate an outbound TCP connection to an attacker-controlled system, which then replies with a crafted packet that trips an unhandled exceptional condition (CWE-754). Juniper-reported with CVSS 4.0 8.2; no public exploit identified at time of analysis and it is not in CISA KEV.
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate data-center links by injecting IPv6 multicast traffic in an EVPN-VxLAN fabric. When such packets reach a non-IRB interface of a spine switch, the packet-forwarding engine floods them to other spines and all ESI leaf switches, creating an endless forwarding loop that starves legitimate traffic. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 7.1.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauthenticated, Layer-2 adjacent attacker crash a line card by sending a single crafted packet within the same broadcast domain. The affected system miscalculates the packet size (CWE-1284, improper validation of specified quantity in input), which fails downstream processing and raises an MQSS major CMError that forces an automatic FPC reset, interrupting all traffic on that FPC until it recovers. Only deployments handling MAP-T or non-IP-over-IP traffic (e.g. MPLS over GRE) are exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Memory exhaustion in Juniper Networks Junos OS BroadBand Edge subscriber management daemon (bbe-smgd) on MX Series allows adjacent unauthenticated attackers to trigger persistent denial of service by sending authentication packets that do not match configured packet-type options. Each mismatched packet leaks memory, eventually consuming all available daemon heap memory and preventing new subscriber logins. Authentication packet-type configuration must be active for exploitation. No public exploit identified at time of analysis.
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services on MX Series routers. Each DHCPv6 subscriber logout in PPPoE or VLAN configurations with active/bulk lease query leaks memory, eventually exhausting resources and triggering jdhcpd crash. Service remains unavailable until process restart completes. Affects all Junos OS versions before 22.4R3-S1, 23.2 versions before 23.2R2, and 23.4 versions before 23.4R2. No public exploit identified at time of analysis.
Memory leak in Juniper Networks l2ald daemon allows adjacent attackers to crash Layer 2 services on EVPN-MPLS networks. Affects Junos OS and Junos OS Evolved across multiple versions. Unauthenticated attackers on the same network segment can trigger resource exhaustion by causing ESI route churn from multi-homed Provider Edge devices, forcing l2ald process crash and restart. No public exploit identified at time of analysis, but exploitation requires only network adjacency without authentication.
Symbolic link manipulation in Juniper Networks Junos OS CLI enables authenticated local attackers with low privileges to escalate to root access. Exploitation requires two users: the first performs a 'file link ...' CLI operation, then after the second user commits unrelated configuration changes, the first user can authenticate as root, achieving full system compromise. Affects Junos OS versions across 23.2, 23.4, 24.2, 24.4, and 25.2 release trains prior to specified patch levels. No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated users with low privileges to gain high-privileged direct access to Flexible PIC Concentrators (FPCs), enabling potential full compromise of affected line cards. Impacts PTX10004, PTX10008, PTX10016 with JNP10K-LC1201 or JNP10K-LC1202 line cards across multiple firmware branches. Missing authentication on critical FPC management functions permits unauthorized privilege elevation. No public exploit identified at time of analysis.
Management daemon deadlock in Juniper Networks Junos OS 23.4-24.4 and Junos OS Evolved enables network-based authenticated attackers to trigger complete management plane denial-of-service via rapid NETCONF session cycling. Vulnerability causes mgd processes to hang in lockf state, exhausting process pool and preventing administrative logins. Recovery requires device power-cycle. Affects deployments using NETCONF management interface with authenticated remote users. No public exploit identified at time of analysis.
Command injection in Juniper Networks Support Insights Virtual Lightweight Collector (JSI vLWC) CLI enables local high-privileged attackers to escalate privileges to root. Inadequate input validation in the CLI menu permits shell command injection, with injected commands executing at root level. All JSI vLWC versions before 3.0.94 affected. CVSS 8.4 (High severity, local vector). Requires high-level existing privileges (PR:H). No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users to execute arbitrary code with root privileges. When unsigned Python operation scripts are enabled in device configuration, attackers can inject and execute malicious op scripts under root-equivalent context, achieving complete system compromise. Affects all Junos OS versions before 22.4R3-S7 and multiple branches through 24.4, plus corresponding Junos OS Evolved releases. No public exploit identified at time of analysis. CVSS 8.5 (High) with local attack vector requiring low privileges and no user interaction.
HTTP header injection in the Juniper Networks Session Smart Router and Session Smart Conductor web server lets remote attackers place attacker-controlled content into HTTP headers via unsanitized request body parameters. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is reachable over the network against an exposed web server with no authentication and no user interaction, but impact is limited to integrity (I:L) with no confidentiality or availability effect, and the scope-changed metric indicates the effect is assessed as extending to a downstream consumer of the injected headers. No public exploit code or active exploitation is indicated in the supplied intelligence, and the practical risk depends on whether the router or conductor management web interface is reachable from untrusted networks; the specific parameters or characters that trigger the injection are not described in the available sources.
Juniper Networks Session Smart Conductor contains an incorrect permission assignment flaw (CWE-732) in its RoutingManager component: processes that write routing credential material into the /tmp directory create it with permissions that other local users can read. The exposed data is sensitive routing credential information, giving confidentiality-only impact; the independent assessment scores this as a local attack (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requiring an existing account on the Conductor host, which conflicts with the vendor's submitted vector (AV:N/AC:H/PR:N/UI:N/S:C) and should be confirmed against advisory JSA112183. The vendor score is 6.8 and the case is triaged for this month rather than immediate action; no CISA KEV listing and no public exploit code were identified at time of analysis.
Local users with low privileges on Juniper Networks Session Smart Router and Session Smart Conductor can force arbitrary filesystem unmounts or a denial-of-service condition in the ember service by creating directories with specially crafted names and then triggering a service restart. The flaw is an output-neutralization (injection) weakness rated CVSS 5.5 with impact confined to availability (C:N/I:N/A:H); the vector requires local access and low privileges (AV:L/PR:L) and no user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-priority label places remediation within this month rather than as an emergency.
Improper initialization in Juniper Networks Session Smart Router can allow unauthenticated network attackers to cause a limited denial of service, and the description also claims traffic decryption even though the scored confidentiality impact is low. The issue is reached through the router's security policy assignment, and the CVSS AC:H rating indicates conditions beyond the attacker's control; the exact trigger is not described in the available sources. No public exploit was identified at time of analysis, and the vuln.today priority is monitor (CVSS 3.7), making this a low-severity issue rather than an urgent one.
Juniper Networks Session Smart Router can be induced to perform an out-of-bounds read (CWE-125) in its VRRPv3 handling by a crafted VRRP advertisement sent from the same Layer 2 segment, allowing an L2-adjacent attacker to expose stale memory contents or fault the routing process. Affected deployments are those where VRRP is configured and actively running on the targeted interface; the attack requires adjacency on the local broadcast domain but no authentication and no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N). The confidentiality and availability impact is limited and the trigger specifics are not described in the available sources; no public exploit has been identified at time of analysis, and the vendor advisory JSA112183 is the authoritative reference.
An out-of-bounds write in TCP header processing in Juniper Networks Session Smart Router lets unauthenticated remote attackers corrupt TCP payload data and potentially desynchronize sessions by passing a transit TCP packet whose SACK option carries an oversized length field. Only devices that process transit TCP traffic on the attacker's network path are exposed, and the high attack complexity reflects that the malformed-option condition is not straightforwardly triggered. Impact is bounded to integrity and availability effects (I:L/A:L) with no confidentiality loss and no evidence of code execution; no public exploit has been identified at time of analysis, and the issue is tracked as a moderate, this-month priority rather than an emergency.
An out-of-bounds write in the TCP proxy/optimization data plane of Juniper Networks Session Smart Router allows network attackers to corrupt forwarded packet data and potentially crash the data plane by sending a transit TCP packet with a crafted TCP option length. The supplied CVSS vector is network-reachable, low-complexity and unauthenticated (PR:N), but exploitation depends on the SSR actually proxying or optimizing the attacker's TCP traffic; the available sources do not state whether that feature is enabled by default. No public exploit identified at time of analysis, and the supplied data does not report CISA KEV status.
Out-of-bounds read in the HttpParser component of Juniper Session Smart Router and Session Smart Conductor allows a remote, unauthenticated attacker to send a crafted HTTP request that degrades availability, assessed as a moderate-severity denial-of-service issue (CVSS 5.3, A:L only) rather than a high-priority emergency. The CVSS vector indicates no privileges or user interaction are required, but impact is confined to availability - no code execution or data exposure is assessed. No public exploit was identified at time of analysis, and the available data does not describe the precise parser trigger.
Improper handling of a length parameter in the L2ALM component of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to read stale packet memory from the Packet Forwarding Engine (PFE) by sending crafted VXLAN overlay-ping traffic to a local VXLAN tunnel endpoint (VTEP). Only devices configured as VTEPs with overlay-ping processing active are exposed, and the attacker must share Layer-2 adjacency with the target, so the flaw is not reachable across routed or Internet paths; impact is limited to low-severity confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no indication of active exploitation. Per the vendor, patches are available; the assigned CVSS 4.0 base score is 5.3, and our independent assessment rates it as a medium-severity information-disclosure issue whose real-world priority is modest and bounded by its adjacency and configuration prerequisites.
Memory exhaustion denial of service in Juniper Networks Junos OS and Junos OS Evolved running on QFX5K-family platforms allows a device that is already a configured EVPN peer to leak memory in the l2ald process by driving EVPN-VXLAN active-active multihoming route processing, eventually starving the daemon and degrading or knocking over the switch. This is a medium-severity, availability-only issue (CVSS 6.9; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) with no data disclosure or modification; there is no public exploit identified at time of analysis, though the assessed vector requires the attacker to hold an established EVPN peering relationship within the fabric rather than being an arbitrary internet host. A vendor patch is available, so only unpatched QFX5K devices with EVPN-VXLAN active-active multihoming configured and reachable by a peer are exposed.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a NULL pointer dereference in the na-grpcd process, which crashes when it receives a crafted network message, making the services that depend on that daemon unavailable on the affected device. Exploitation requires network reachability into the chassis-internal (control-plane fabric) network, which is not normally exposed to WAN or ordinary management networks, so real-world exposure is limited; the advisory describes an unauthenticated attacker while the published CVSS 4.0 vector lists PR:H, leaving the precise account-level requirement ambiguous - the concrete gating condition is privileged access to the internal chassis network. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed software under advisory JSA112187.
A reachable-assertion flaw in the Juniper Junos OS and Junos OS Evolved rpd routing daemon lets a network-adjacent attacker crash the daemon by sending a crafted LDP Label message that carries an IPv6 Prefix FEC, producing a denial-of-service condition (CVSS 4.0 base 7.1; availability-only). The attacker must already share an L2 segment or act as a directly connected routing peer and must have an established LDP session with the target, so only devices with LDP configured and actively exchanging IPv6 Prefix FEC bindings are exposed; no authentication or user interaction is required once that adjacency exists (PR:N, UI:N), and the daemon's automatic restart bounds each outage. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); impact is limited to availability, with no confidentiality or integrity effect.
Juniper Junos OS and Junos OS Evolved devices that run OSPFv3 on a broadcast interface can be crashed by an unauthenticated adjacent attacker who sends specially crafted OSPFv3 protocol messages to the rpd routing daemon, producing a denial of service and heap memory corruption. Exploitation requires only Layer-2 adjacency to the affected broadcast segment and no credentials or user interaction, but devices that do not run OSPFv3, or that use point-to-point interface types, are not exposed; no public exploit code has been identified at time of analysis. Vendor severity is moderate (CVSS 4.0 7.1) with an availability-only impact, aligning with our independent CVSS 3.1 assessment of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
Malformed PIM Hello messages can crash the rpd process in Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on IPv6-enabled PIM interfaces. This improper input validation flaw (CWE-20) is exploitable by an unauthenticated adjacent attacker (AV:A) without user interaction, but requires PIM to be configured and the target interface to be IPv6-enabled. No public exploit code or active exploitation is known; the CVSS 4.0 base score is 7.1, and independent assessment classifies this as a moderate-severity availability issue with a bounded exposed population.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows a remote attacker who already holds an established EVPN BGP peering relationship with a target device to disrupt the routing protocol daemon (rpd) by sending EVPN BGP routes that trigger an integer overflow or wraparound. The flaw affects EVPN-enabled routing instances and can tear down control-plane adjacencies and halt route processing, producing an availability-only impact with no confidentiality or integrity effect. EVPN is a deliberately configured, non-default feature and the peering trust relationship must pre-exist, so realistic exploitation is limited to EVPN deployments and adjacent or compromised BGP peers; no public exploit code was identified at time of analysis, and the vendor advisory is Juniper JSA112187.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, peer-trusted attacker to crash the routing protocol daemon (rpd) by sending specially crafted EVPN route updates. Exploitation requires an established, accepted EVPN BGP peering session with the attacker controlling or compromising the peer endpoint; routers without EVPN/BGP signaling configured or without the attacker in their accepted-peer set are not exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis; risk is limited to availability (no confidentiality or integrity impact), but the flaw is a genuine operational priority for networks running EVPN.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-positioned attacker to disrupt the routing protocol daemon (rpd) by delivering a crafted BGP EVPN update message. Affected releases include multiple Junos OS and Junos OS Evolved versions, but exposure requires that BGP with the EVPN address family be configured - a non-default setting typical of EVPN-VXLAN data center fabrics - and the attacker must be able to reach rpd over an established BGP EVPN session (a configured peer or an on-path attacker on the peering path). Impact is availability-only (control-plane DoS) with no confidentiality or integrity exposure; no public exploit identified at time of analysis, and vendor patches are available.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved can be triggered in the routing protocol daemon (rpd) by a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. The vendor rates this 8.7, while independent assessment maps it to high availability impact (CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with no confidentiality or integrity loss; the practical precondition is an established EVPN peering relationship, so an arbitrary internet host is not sufficient despite the unauthenticated CVSS vector. No public exploit code or CISA KEV active exploitation is identified in the provided data at time of analysis, and affected deployments are those running EVPN on unpatched Junos OS or Junos OS Evolved releases.
Denial of service in Juniper Junos OS and Junos OS Evolved rpd allows a configured BGP neighbor to crash the routing protocol daemon by sending a crafted BGP route update when both resolution-map routing policy and policy event-tracing are enabled. The flaw is a NULL pointer dereference (CWE-476) affecting multiple release trains; exploitation requires the non-default combination of those two features and an existing BGP peering relationship, so baseline or non-peered devices are not exposed. Juniper has released patches via advisory JSA112187, and no public exploit identified at time of analysis.
A NULL pointer dereference in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved lets an unauthenticated, already-configured BGP peer crash the routing process by sending a crafted BGP UPDATE, producing a denial of service, but only on devices where both ISO-VPN and egress-protection are enabled - a non-default feature combination. The CVSS 4.0 vector scores 8.7 (High) and is driven entirely by availability impact (VC:N/VI:N/VA:H/SC:N/SI:N/SA:L), with no confidentiality or integrity loss. No public exploit code and no confirmed active exploitation were identified at time of analysis; arbitrary Internet hosts cannot reach the vulnerable code path because the sender must already be an operator-configured BGP peer of the target device.
A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.
An integer underflow in the srxpfe forwarding-plane daemon of Junos OS and Junos OS Evolved on SRX Series firewalls allows an unauthenticated attacker on an adjacent network segment to trigger a denial of service by sending an ICMP message tied to an SVR (Secure Vector Routing) carrier session. Affected deployments are those running SVR/carrier-session functionality on SRX platforms, where successful exploitation degrades or halts packet forwarding; the CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss (assessed CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis, but the attack requires only Layer 2 adjacency and no credentials or user interaction, so any SRX device with SVR sessions reachable from an untrusted adjacent segment should be treated as exposed.
Denial of service in Juniper Networks SRX Series firewalls running Junos OS in a chassis-cluster (high-availability) configuration allows an adjacent attacker to crash the data plane by sending crafted traffic over the chassis-cluster fabric interconnect. The flaw is a signed-to-unsigned conversion error (CWE-195) in the srxpfe packet forwarding engine; authentication requirements are confirmed as unauthenticated (PR:N) and no user interaction is needed (UI:N) once the attacker has a position on the fabric. There is no public exploit identified at time of analysis and no record of confirmed active exploitation (CISA KEV), and the attack surface is restricted to clustered deployments rather than general network exposure, making this an access-constrained availability threat.
Malformed firewall-authentication synchronization traffic delivered over a chassis-cluster fabric link can trip a reachable assertion in the srxpfe process on Juniper Networks SRX Series devices running Junos OS, aborting the packet forwarding engine and causing a denial of service of the data plane for traffic traversing the cluster. Exposure is limited to SRX platforms deployed in chassis-cluster high-availability configurations where firewall-authentication synchronization is in use; standalone SRX devices and clusters that do not use that synchronization mechanism are unaffected, and the attacker must already have a position on the normally dedicated point-to-point fabric interconnect (logically adjacent, with no authentication or user interaction required per the assessed vectors). At the time of analysis no public exploit code and no confirmed active exploitation were identified; the CVSS 4.0 base score is 7.1 with availability-only impact (VC:N/VI:N/VA:H), and the vendor advisory is Juniper JSA112186.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to crash or destabilize the routing daemon (rpd) by sending a specially crafted IS-IS SRv6 packet, disrupting routing on the affected device. Exploitation is tightly constrained: the device must have both SRv6 and Flexible Algorithm explicitly enabled in its IS-IS configuration (a non-default segment-routing setup), and the attacker must already sit on an adjacent network segment able to inject IS-IS packets into the routing domain - a remote Internet attacker cannot reach this path. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with an assessed CVSS:3.1 base of AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (vendor score 7.1 under CVSS 4.0), it is a moderate-priority, availability-only issue whose real-world exposure is narrowed by its configuration prerequisites and adjacency requirement.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.
A malformed BGP VPLS signaling update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on the affected device. The flaw is improper input validation (CWE-20) in rpd's handling of BGP signaling messages; the attack vector is adjacent and the CVSS 4.0 vector carries PR:N (no privileges required), but successful exploitation requires the target to be running BGP with VPLS signaling configured and to already have an established peering relationship with the attacking peer. Impact is limited to availability (rpd restart, routing churn, potential traffic loss) with no confidentiality or integrity impact; no public exploit code has been identified and there is no KEV confirmation of active exploitation at time of analysis, so this is a genuine but bounded operational risk rather than an urgent emergency.
An adjacent eBGP peer can crash the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted VPLS signaling update, but only on routers where VPLS automatic site-ID negotiation is enabled and an external BGP peering session is already established. The flaw is a reachable assertion (CWE-617) in rpd that terminates the process, producing a denial of service with no confidentiality or integrity impact; Juniper rates it 7.1 under CVSS 4.0, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, treating it as a moderate-priority availability issue rather than an emergency. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so risk is concentrated in networks that combine external BGP peering with non-default VPLS auto site-ID negotiation.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG with ICCP can be disrupted by an adjacent, unauthenticated attacker who sends an inconsistent ICCP peer message that triggers a reachable assertion in the l2ald daemon. Successful exploitation results in a denial of service affecting availability, with no confidentiality or integrity impact; no public exploit was identified at time of analysis, and the attack is limited to environments that have the non-default MC-LAG/ICCP redundancy feature enabled and where the attacker can reach the ICCP peer relationship at Layer 2.
Crashing the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is possible via a malformed BGP MCAST-VPN update sent from a configured eBGP peer, resulting in a denial-of-service condition. Exploitation is gated: the target must have the BGP multicast-VPN (MVPN) address family active and an established eBGP peering relationship, so realistic attackers are limited to peering or adjacent networks rather than the general internet. No public exploit code or confirmed active exploitation exists at time of analysis, and the vendor advisory (JSA112187) should be consulted for patch availability.
Denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to disrupt or crash RSVP processing by sending a malformed RSVP packet to an interface where RSVP is explicitly enabled. Exploitation is conditional: RSVP is not enabled by default and is only present in MPLS traffic-engineering/signaling deployments, and the attacker must have Layer-2 or directly-reachable adjacency to the affected interface (CVSS AV:A, PR:N, UI:N), so routers without RSVP configured are not exposed. Impact is availability-only with no confidentiality or integrity exposure; vendor CVSS is 7.1, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
OS command injection in the Junos OS CLI lets an authenticated, low-privileged local user escalate to full root control of the device by passing unsanitized arguments to the 'request csds' operational command. Only Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3) are affected; releases before 24.4R1 are explicitly unaffected, and the attack is strictly local with no network or unauthenticated path. There is no public exploit identified at time of analysis, and Juniper has released fixed versions (24.4R2-S4, 25.2R2-S1, 25.4R1-S3), making this a serious but access-gated issue rather than an internet-facing emergency.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
A malformed BGP-signaled SRv6 service route can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service that disrupts routing on the affected device. The issue is remotely triggerable with no credentials or user interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, VA:H), scoring 8.7, but it is conditional: exploitation requires that SRv6 dynamic tunnels be explicitly enabled (a non-default configuration) and that the attacker already hold an established BGP peering session with the target. Impact is limited to availability of the routing daemon - there is no confidentiality or integrity impact - and no public exploit has been identified at time of analysis. All software versions enumerated by the vendor are unpatched; Juniper has released fixed builds.
Malformed OSPF packets crafted by an adjacent OSPF peer can crash the Juniper Networks Junos OS rpd routing daemon or disclose portions of its process memory, affecting both Junos OS and Junos OS Evolved builds below the fixed releases enumerated in JSA112187 (for example Junos OS prior to 23.2R2-S7.7, 24.2R2-S5.5 and 25.2R2-S2, and the corresponding -EVO builds). The weakness is an unauthenticated adjacent attack (CVSS v4.0 base 7.1, AV:A/PR:N/UI:N with high availability and low confidentiality impact), meaning the attacker must already hold or establish OSPF adjacency on the same routing segment, so exposure is confined to devices actively running OSPF rather than the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are already available, making this a moderate-priority routing-infrastructure issue rather than a mass-exploitation emergency.
Crafted RSVP packets can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on devices where non-default Layer 2 label-switched path (L2 LSP) RSVP signaling is enabled. The issue is an adjacent-network, unauthenticated attack (CVSS v4.0 7.1, AV:A/AC:L/PR:N/UI:N, availability-only impact, and our independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/A:H): the attacker must sit on the same Layer 2 segment as the target but needs no credentials and no user interaction, and a single malformed packet is sufficient. No public exploit code exists and there is no confirmed active exploitation at time of analysis, and the practical exposure is bounded because L2 LSP support is a non-default configuration; Juniper advisory JSA112187 provides patched releases.
A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
An authenticated format-string vulnerability in the gRPC daemon that backs the gNMI service on Juniper Networks Junos OS Evolved lets a network attacker who holds valid low-privileged credentials feed crafted format specifiers into a telemetry code path, with potential outcomes ranging from telemetry-service disruption and information disclosure up to root-level code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is remote but requires an authenticated session against an enabled, network-reachable gNMI interface - it is not reachable by a fully anonymous attacker. At the time of analysis there is no CISA KEV entry and no public exploit code identified, and the vendor has published advisory JSA112250; this is a credible priority for organizations running Evolved with gNMI exposure, but not a drop-everything emergency on the available signals.
Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon allows adjacent attackers on the management LAN to execute arbitrary commands as root via a crafted DHCP response. The vulnerability has a CVSS 4.0 base score of 9.3 and requires the target device to be actively in ZTP mode; no public exploit code is identified at time of analysis.
A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.
Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evolved on PTX Series routers allows an attacker positioned on the management LAN to execute arbitrary commands as root by sending a crafted gRPC response to a device that is actively provisioning. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting low attack complexity, no authentication or user interaction requirements, and full confidentiality, integrity, and availability impact; the adjacent-network attack vector (AV:A) means the device is not exploitable directly from the internet. No public exploit code has been identified at time of analysis, no CISA KEV listing or EPSS score was provided, and exposure is materially reduced where management traffic runs over a segmented or physically isolated out-of-band network and where devices are not in an active ZTP state.
Unauthenticated adjacent IS-IS peers can cause a denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series by sending crafted input that fails proper quantity validation (CWE-1284). This medium-severity flaw (CVSS 6.5, AV:A/PR:N/UI:N/A:H) requires the attacker to hold Layer 2 adjacency on a directly connected or shared broadcast segment; no authentication or user interaction is needed. No public exploit code has been identified at time of analysis.
Persistent telemetry dial-out denial of service in Juniper Networks Junos OS Evolved allows an attacker with management-plane access to the device's gNMI listener to crash or wedge the jti-dialoutd telemetry process by submitting a crafted analytics sensor resource that is consumed as a format string (CWE-134). Exploitation requires the gNMI listener to be reachable and enabled with telemetry/JTI dial-out configured, and Juniper's description characterizes the actor as authenticated; note that the published CVSS vector lists PR:N, which contradicts that authentication prerequisite and should be reconciled against Juniper advisory JSA112250. Impact is confined to loss of telemetry dial-out and analytics streaming rather than data-plane forwarding, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low-privileged authenticated attacker crash the Flexible PIC Concentrator (FPC) by subscribing over gRPC to an unsupported telemetry sensor path in the packet forwarding engine. Each crash produces a complete forwarding outage until the module auto-restarts, and the trigger can be repeated for sustained disruption. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low complexity and single low-privilege prerequisite make it operationally easy to trigger.
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exhaust the packet forwarding engine (PFE) by exploiting a race condition in stateful flow teardown. When the race is hit, a flow's timeout is mis-set to a very high value (>10,000s instead of 3s), so sessions are never reaped, invalidated sessions accumulate without bound, and the device eventually stops forwarding or hits a flowd core and reboots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is probabilistic because the triggering conditions are outside the attacker's control.
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker to exhaust packet-forwarding-engine memory and crash the Flexible PIC Concentrator (FPC). The flaw triggers only when sFlow monitoring is enabled in a Virtual Chassis and multicast traffic ingresses on one VC member and egresses on another, causing a slow buffer leak that culminates in an FPC crash and restart. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability risk for affected deployments.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated, network-based attacker to crash the flow processing daemon (flowd) by sending a malformed SIP INVITE packet when the SIP Application Layer Gateway (ALG) is enabled. The crash forces a flowd restart, producing a complete traffic-forwarding outage until the device auto-recovers, and can be repeated to sustain the outage. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. Because TCP proxy is engaged whenever ALGs, Advanced Anti-Malware, ICAP, or UTM services inspect a flow, exploitation forces a complete traffic-forwarding outage until the daemon auto-restarts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat to perimeter devices.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls lets an unauthenticated, network-based attacker crash and restart the PFE, dropping all traffic-forwarding services until automatic recovery. Exploitation is indirect: the attacker must lure or wait for the affected device to initiate an outbound TCP connection to an attacker-controlled system, which then replies with a crafted packet that trips an unhandled exceptional condition (CWE-754). Juniper-reported with CVSS 4.0 8.2; no public exploit identified at time of analysis and it is not in CISA KEV.
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate data-center links by injecting IPv6 multicast traffic in an EVPN-VxLAN fabric. When such packets reach a non-IRB interface of a spine switch, the packet-forwarding engine floods them to other spines and all ESI leaf switches, creating an endless forwarding loop that starves legitimate traffic. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 7.1.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauthenticated, Layer-2 adjacent attacker crash a line card by sending a single crafted packet within the same broadcast domain. The affected system miscalculates the packet size (CWE-1284, improper validation of specified quantity in input), which fails downstream processing and raises an MQSS major CMError that forces an automatic FPC reset, interrupting all traffic on that FPC until it recovers. Only deployments handling MAP-T or non-IP-over-IP traffic (e.g. MPLS over GRE) are exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Memory exhaustion in Juniper Networks Junos OS BroadBand Edge subscriber management daemon (bbe-smgd) on MX Series allows adjacent unauthenticated attackers to trigger persistent denial of service by sending authentication packets that do not match configured packet-type options. Each mismatched packet leaks memory, eventually consuming all available daemon heap memory and preventing new subscriber logins. Authentication packet-type configuration must be active for exploitation. No public exploit identified at time of analysis.
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services on MX Series routers. Each DHCPv6 subscriber logout in PPPoE or VLAN configurations with active/bulk lease query leaks memory, eventually exhausting resources and triggering jdhcpd crash. Service remains unavailable until process restart completes. Affects all Junos OS versions before 22.4R3-S1, 23.2 versions before 23.2R2, and 23.4 versions before 23.4R2. No public exploit identified at time of analysis.
Memory leak in Juniper Networks l2ald daemon allows adjacent attackers to crash Layer 2 services on EVPN-MPLS networks. Affects Junos OS and Junos OS Evolved across multiple versions. Unauthenticated attackers on the same network segment can trigger resource exhaustion by causing ESI route churn from multi-homed Provider Edge devices, forcing l2ald process crash and restart. No public exploit identified at time of analysis, but exploitation requires only network adjacency without authentication.
Symbolic link manipulation in Juniper Networks Junos OS CLI enables authenticated local attackers with low privileges to escalate to root access. Exploitation requires two users: the first performs a 'file link ...' CLI operation, then after the second user commits unrelated configuration changes, the first user can authenticate as root, achieving full system compromise. Affects Junos OS versions across 23.2, 23.4, 24.2, 24.4, and 25.2 release trains prior to specified patch levels. No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated users with low privileges to gain high-privileged direct access to Flexible PIC Concentrators (FPCs), enabling potential full compromise of affected line cards. Impacts PTX10004, PTX10008, PTX10016 with JNP10K-LC1201 or JNP10K-LC1202 line cards across multiple firmware branches. Missing authentication on critical FPC management functions permits unauthorized privilege elevation. No public exploit identified at time of analysis.
Management daemon deadlock in Juniper Networks Junos OS 23.4-24.4 and Junos OS Evolved enables network-based authenticated attackers to trigger complete management plane denial-of-service via rapid NETCONF session cycling. Vulnerability causes mgd processes to hang in lockf state, exhausting process pool and preventing administrative logins. Recovery requires device power-cycle. Affects deployments using NETCONF management interface with authenticated remote users. No public exploit identified at time of analysis.
Command injection in Juniper Networks Support Insights Virtual Lightweight Collector (JSI vLWC) CLI enables local high-privileged attackers to escalate privileges to root. Inadequate input validation in the CLI menu permits shell command injection, with injected commands executing at root level. All JSI vLWC versions before 3.0.94 affected. CVSS 8.4 (High severity, local vector). Requires high-level existing privileges (PR:H). No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users to execute arbitrary code with root privileges. When unsigned Python operation scripts are enabled in device configuration, attackers can inject and execute malicious op scripts under root-equivalent context, achieving complete system compromise. Affects all Junos OS versions before 22.4R3-S7 and multiple branches through 24.4, plus corresponding Junos OS Evolved releases. No public exploit identified at time of analysis. CVSS 8.5 (High) with local attack vector requiring low privileges and no user interaction.
HTTP header injection in the Juniper Networks Session Smart Router and Session Smart Conductor web server lets remote attackers place attacker-controlled content into HTTP headers via unsanitized request body parameters. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is reachable over the network against an exposed web server with no authentication and no user interaction, but impact is limited to integrity (I:L) with no confidentiality or availability effect, and the scope-changed metric indicates the effect is assessed as extending to a downstream consumer of the injected headers. No public exploit code or active exploitation is indicated in the supplied intelligence, and the practical risk depends on whether the router or conductor management web interface is reachable from untrusted networks; the specific parameters or characters that trigger the injection are not described in the available sources.
Juniper Networks Session Smart Conductor contains an incorrect permission assignment flaw (CWE-732) in its RoutingManager component: processes that write routing credential material into the /tmp directory create it with permissions that other local users can read. The exposed data is sensitive routing credential information, giving confidentiality-only impact; the independent assessment scores this as a local attack (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requiring an existing account on the Conductor host, which conflicts with the vendor's submitted vector (AV:N/AC:H/PR:N/UI:N/S:C) and should be confirmed against advisory JSA112183. The vendor score is 6.8 and the case is triaged for this month rather than immediate action; no CISA KEV listing and no public exploit code were identified at time of analysis.
Local users with low privileges on Juniper Networks Session Smart Router and Session Smart Conductor can force arbitrary filesystem unmounts or a denial-of-service condition in the ember service by creating directories with specially crafted names and then triggering a service restart. The flaw is an output-neutralization (injection) weakness rated CVSS 5.5 with impact confined to availability (C:N/I:N/A:H); the vector requires local access and low privileges (AV:L/PR:L) and no user interaction. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-priority label places remediation within this month rather than as an emergency.
Improper initialization in Juniper Networks Session Smart Router can allow unauthenticated network attackers to cause a limited denial of service, and the description also claims traffic decryption even though the scored confidentiality impact is low. The issue is reached through the router's security policy assignment, and the CVSS AC:H rating indicates conditions beyond the attacker's control; the exact trigger is not described in the available sources. No public exploit was identified at time of analysis, and the vuln.today priority is monitor (CVSS 3.7), making this a low-severity issue rather than an urgent one.
Juniper Networks Session Smart Router can be induced to perform an out-of-bounds read (CWE-125) in its VRRPv3 handling by a crafted VRRP advertisement sent from the same Layer 2 segment, allowing an L2-adjacent attacker to expose stale memory contents or fault the routing process. Affected deployments are those where VRRP is configured and actively running on the targeted interface; the attack requires adjacency on the local broadcast domain but no authentication and no user interaction (CVSS:3.1/AV:A/AC:L/PR:N/UI:N). The confidentiality and availability impact is limited and the trigger specifics are not described in the available sources; no public exploit has been identified at time of analysis, and the vendor advisory JSA112183 is the authoritative reference.
An out-of-bounds write in TCP header processing in Juniper Networks Session Smart Router lets unauthenticated remote attackers corrupt TCP payload data and potentially desynchronize sessions by passing a transit TCP packet whose SACK option carries an oversized length field. Only devices that process transit TCP traffic on the attacker's network path are exposed, and the high attack complexity reflects that the malformed-option condition is not straightforwardly triggered. Impact is bounded to integrity and availability effects (I:L/A:L) with no confidentiality loss and no evidence of code execution; no public exploit has been identified at time of analysis, and the issue is tracked as a moderate, this-month priority rather than an emergency.
An out-of-bounds write in the TCP proxy/optimization data plane of Juniper Networks Session Smart Router allows network attackers to corrupt forwarded packet data and potentially crash the data plane by sending a transit TCP packet with a crafted TCP option length. The supplied CVSS vector is network-reachable, low-complexity and unauthenticated (PR:N), but exploitation depends on the SSR actually proxying or optimizing the attacker's TCP traffic; the available sources do not state whether that feature is enabled by default. No public exploit identified at time of analysis, and the supplied data does not report CISA KEV status.
Out-of-bounds read in the HttpParser component of Juniper Session Smart Router and Session Smart Conductor allows a remote, unauthenticated attacker to send a crafted HTTP request that degrades availability, assessed as a moderate-severity denial-of-service issue (CVSS 5.3, A:L only) rather than a high-priority emergency. The CVSS vector indicates no privileges or user interaction are required, but impact is confined to availability - no code execution or data exposure is assessed. No public exploit was identified at time of analysis, and the available data does not describe the precise parser trigger.
Improper handling of a length parameter in the L2ALM component of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to read stale packet memory from the Packet Forwarding Engine (PFE) by sending crafted VXLAN overlay-ping traffic to a local VXLAN tunnel endpoint (VTEP). Only devices configured as VTEPs with overlay-ping processing active are exposed, and the attacker must share Layer-2 adjacency with the target, so the flaw is not reachable across routed or Internet paths; impact is limited to low-severity confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and there is no indication of active exploitation. Per the vendor, patches are available; the assigned CVSS 4.0 base score is 5.3, and our independent assessment rates it as a medium-severity information-disclosure issue whose real-world priority is modest and bounded by its adjacency and configuration prerequisites.
Memory exhaustion denial of service in Juniper Networks Junos OS and Junos OS Evolved running on QFX5K-family platforms allows a device that is already a configured EVPN peer to leak memory in the l2ald process by driving EVPN-VXLAN active-active multihoming route processing, eventually starving the daemon and degrading or knocking over the switch. This is a medium-severity, availability-only issue (CVSS 6.9; assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/C:N/I:N/A:L) with no data disclosure or modification; there is no public exploit identified at time of analysis, though the assessed vector requires the attacker to hold an established EVPN peering relationship within the fabric rather than being an arbitrary internet host. A vendor patch is available, so only unpatched QFX5K devices with EVPN-VXLAN active-active multihoming configured and reachable by a peer are exposed.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved results from a NULL pointer dereference in the na-grpcd process, which crashes when it receives a crafted network message, making the services that depend on that daemon unavailable on the affected device. Exploitation requires network reachability into the chassis-internal (control-plane fabric) network, which is not normally exposed to WAN or ordinary management networks, so real-world exposure is limited; the advisory describes an unauthenticated attacker while the published CVSS 4.0 vector lists PR:H, leaving the precise account-level requirement ambiguous - the concrete gating condition is privileged access to the internal chassis network. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Juniper has released fixed software under advisory JSA112187.