Juniper
Monthly
A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.
An integer underflow in the srxpfe forwarding-plane daemon of Junos OS and Junos OS Evolved on SRX Series firewalls allows an unauthenticated attacker on an adjacent network segment to trigger a denial of service by sending an ICMP message tied to an SVR (Secure Vector Routing) carrier session. Affected deployments are those running SVR/carrier-session functionality on SRX platforms, where successful exploitation degrades or halts packet forwarding; the CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss (assessed CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis, but the attack requires only Layer 2 adjacency and no credentials or user interaction, so any SRX device with SVR sessions reachable from an untrusted adjacent segment should be treated as exposed.
Denial of service in Juniper Networks SRX Series firewalls running Junos OS in a chassis-cluster (high-availability) configuration allows an adjacent attacker to crash the data plane by sending crafted traffic over the chassis-cluster fabric interconnect. The flaw is a signed-to-unsigned conversion error (CWE-195) in the srxpfe packet forwarding engine; authentication requirements are confirmed as unauthenticated (PR:N) and no user interaction is needed (UI:N) once the attacker has a position on the fabric. There is no public exploit identified at time of analysis and no record of confirmed active exploitation (CISA KEV), and the attack surface is restricted to clustered deployments rather than general network exposure, making this an access-constrained availability threat.
Malformed firewall-authentication synchronization traffic delivered over a chassis-cluster fabric link can trip a reachable assertion in the srxpfe process on Juniper Networks SRX Series devices running Junos OS, aborting the packet forwarding engine and causing a denial of service of the data plane for traffic traversing the cluster. Exposure is limited to SRX platforms deployed in chassis-cluster high-availability configurations where firewall-authentication synchronization is in use; standalone SRX devices and clusters that do not use that synchronization mechanism are unaffected, and the attacker must already have a position on the normally dedicated point-to-point fabric interconnect (logically adjacent, with no authentication or user interaction required per the assessed vectors). At the time of analysis no public exploit code and no confirmed active exploitation were identified; the CVSS 4.0 base score is 7.1 with availability-only impact (VC:N/VI:N/VA:H), and the vendor advisory is Juniper JSA112186.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to crash or destabilize the routing daemon (rpd) by sending a specially crafted IS-IS SRv6 packet, disrupting routing on the affected device. Exploitation is tightly constrained: the device must have both SRv6 and Flexible Algorithm explicitly enabled in its IS-IS configuration (a non-default segment-routing setup), and the attacker must already sit on an adjacent network segment able to inject IS-IS packets into the routing domain - a remote Internet attacker cannot reach this path. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with an assessed CVSS:3.1 base of AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (vendor score 7.1 under CVSS 4.0), it is a moderate-priority, availability-only issue whose real-world exposure is narrowed by its configuration prerequisites and adjacency requirement.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.
A malformed BGP VPLS signaling update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on the affected device. The flaw is improper input validation (CWE-20) in rpd's handling of BGP signaling messages; the attack vector is adjacent and the CVSS 4.0 vector carries PR:N (no privileges required), but successful exploitation requires the target to be running BGP with VPLS signaling configured and to already have an established peering relationship with the attacking peer. Impact is limited to availability (rpd restart, routing churn, potential traffic loss) with no confidentiality or integrity impact; no public exploit code has been identified and there is no KEV confirmation of active exploitation at time of analysis, so this is a genuine but bounded operational risk rather than an urgent emergency.
An adjacent eBGP peer can crash the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted VPLS signaling update, but only on routers where VPLS automatic site-ID negotiation is enabled and an external BGP peering session is already established. The flaw is a reachable assertion (CWE-617) in rpd that terminates the process, producing a denial of service with no confidentiality or integrity impact; Juniper rates it 7.1 under CVSS 4.0, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, treating it as a moderate-priority availability issue rather than an emergency. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so risk is concentrated in networks that combine external BGP peering with non-default VPLS auto site-ID negotiation.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG with ICCP can be disrupted by an adjacent, unauthenticated attacker who sends an inconsistent ICCP peer message that triggers a reachable assertion in the l2ald daemon. Successful exploitation results in a denial of service affecting availability, with no confidentiality or integrity impact; no public exploit was identified at time of analysis, and the attack is limited to environments that have the non-default MC-LAG/ICCP redundancy feature enabled and where the attacker can reach the ICCP peer relationship at Layer 2.
Crashing the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is possible via a malformed BGP MCAST-VPN update sent from a configured eBGP peer, resulting in a denial-of-service condition. Exploitation is gated: the target must have the BGP multicast-VPN (MVPN) address family active and an established eBGP peering relationship, so realistic attackers are limited to peering or adjacent networks rather than the general internet. No public exploit code or confirmed active exploitation exists at time of analysis, and the vendor advisory (JSA112187) should be consulted for patch availability.
Denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to disrupt or crash RSVP processing by sending a malformed RSVP packet to an interface where RSVP is explicitly enabled. Exploitation is conditional: RSVP is not enabled by default and is only present in MPLS traffic-engineering/signaling deployments, and the attacker must have Layer-2 or directly-reachable adjacency to the affected interface (CVSS AV:A, PR:N, UI:N), so routers without RSVP configured are not exposed. Impact is availability-only with no confidentiality or integrity exposure; vendor CVSS is 7.1, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
OS command injection in the Junos OS CLI lets an authenticated, low-privileged local user escalate to full root control of the device by passing unsanitized arguments to the 'request csds' operational command. Only Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3) are affected; releases before 24.4R1 are explicitly unaffected, and the attack is strictly local with no network or unauthenticated path. There is no public exploit identified at time of analysis, and Juniper has released fixed versions (24.4R2-S4, 25.2R2-S1, 25.4R1-S3), making this a serious but access-gated issue rather than an internet-facing emergency.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
A malformed BGP-signaled SRv6 service route can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service that disrupts routing on the affected device. The issue is remotely triggerable with no credentials or user interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, VA:H), scoring 8.7, but it is conditional: exploitation requires that SRv6 dynamic tunnels be explicitly enabled (a non-default configuration) and that the attacker already hold an established BGP peering session with the target. Impact is limited to availability of the routing daemon - there is no confidentiality or integrity impact - and no public exploit has been identified at time of analysis. All software versions enumerated by the vendor are unpatched; Juniper has released fixed builds.
Malformed OSPF packets crafted by an adjacent OSPF peer can crash the Juniper Networks Junos OS rpd routing daemon or disclose portions of its process memory, affecting both Junos OS and Junos OS Evolved builds below the fixed releases enumerated in JSA112187 (for example Junos OS prior to 23.2R2-S7.7, 24.2R2-S5.5 and 25.2R2-S2, and the corresponding -EVO builds). The weakness is an unauthenticated adjacent attack (CVSS v4.0 base 7.1, AV:A/PR:N/UI:N with high availability and low confidentiality impact), meaning the attacker must already hold or establish OSPF adjacency on the same routing segment, so exposure is confined to devices actively running OSPF rather than the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are already available, making this a moderate-priority routing-infrastructure issue rather than a mass-exploitation emergency.
Crafted RSVP packets can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on devices where non-default Layer 2 label-switched path (L2 LSP) RSVP signaling is enabled. The issue is an adjacent-network, unauthenticated attack (CVSS v4.0 7.1, AV:A/AC:L/PR:N/UI:N, availability-only impact, and our independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/A:H): the attacker must sit on the same Layer 2 segment as the target but needs no credentials and no user interaction, and a single malformed packet is sufficient. No public exploit code exists and there is no confirmed active exploitation at time of analysis, and the practical exposure is bounded because L2 LSP support is a non-default configuration; Juniper advisory JSA112187 provides patched releases.
A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
An authenticated format-string vulnerability in the gRPC daemon that backs the gNMI service on Juniper Networks Junos OS Evolved lets a network attacker who holds valid low-privileged credentials feed crafted format specifiers into a telemetry code path, with potential outcomes ranging from telemetry-service disruption and information disclosure up to root-level code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is remote but requires an authenticated session against an enabled, network-reachable gNMI interface - it is not reachable by a fully anonymous attacker. At the time of analysis there is no CISA KEV entry and no public exploit code identified, and the vendor has published advisory JSA112250; this is a credible priority for organizations running Evolved with gNMI exposure, but not a drop-everything emergency on the available signals.
Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon allows adjacent attackers on the management LAN to execute arbitrary commands as root via a crafted DHCP response. The vulnerability has a CVSS 4.0 base score of 9.3 and requires the target device to be actively in ZTP mode; no public exploit code is identified at time of analysis.
A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.
Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evolved on PTX Series routers allows an attacker positioned on the management LAN to execute arbitrary commands as root by sending a crafted gRPC response to a device that is actively provisioning. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting low attack complexity, no authentication or user interaction requirements, and full confidentiality, integrity, and availability impact; the adjacent-network attack vector (AV:A) means the device is not exploitable directly from the internet. No public exploit code has been identified at time of analysis, no CISA KEV listing or EPSS score was provided, and exposure is materially reduced where management traffic runs over a segmented or physically isolated out-of-band network and where devices are not in an active ZTP state.
Unauthenticated adjacent IS-IS peers can cause a denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series by sending crafted input that fails proper quantity validation (CWE-1284). This medium-severity flaw (CVSS 6.5, AV:A/PR:N/UI:N/A:H) requires the attacker to hold Layer 2 adjacency on a directly connected or shared broadcast segment; no authentication or user interaction is needed. No public exploit code has been identified at time of analysis.
Persistent telemetry dial-out denial of service in Juniper Networks Junos OS Evolved allows an attacker with management-plane access to the device's gNMI listener to crash or wedge the jti-dialoutd telemetry process by submitting a crafted analytics sensor resource that is consumed as a format string (CWE-134). Exploitation requires the gNMI listener to be reachable and enabled with telemetry/JTI dial-out configured, and Juniper's description characterizes the actor as authenticated; note that the published CVSS vector lists PR:N, which contradicts that authentication prerequisite and should be reconciled against Juniper advisory JSA112250. Impact is confined to loss of telemetry dial-out and analytics streaming rather than data-plane forwarding, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote denial-of-service in Juniper Networks Junos OS and Junos OS Evolved 25.2 (before 25.2R2 / 25.2R2-EVO) lets an adjacent, unauthenticated BGP peer crash the routing protocol daemon (RPD) by sending a single malformed non-inet/inet6 unicast BGP update over an already-established session. The RPD crash-and-restart produces a full routing outage until reconvergence completes, though the crash occurs before the update is readvertised so there is no downstream propagation to other routers. CVSS 4.0 base score is 7.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in the Packet Forwarding Engine of Juniper Junos OS on MX Series routers allows an unauthenticated, network-adjacent attacker to crash and restart the FPC by continuously flapping Micro-BFD sessions. The PFEMAN process queues each up/down event and, in a Virtual-Chassis deployment with locality-bias enabled, processing is slow enough that a sustained flap backlog prevents completion and trips the PFEMAN watchdog timer, forcing an FPC restart and a full traffic outage. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the low complexity and unauthenticated adjacent vector make it a credible availability threat to affected line cards (MPC9 and below).
Denial-of-service in Juniper Junos OS Evolved on PTX Series routers lets an unauthenticated network attacker crash the advanced forwarding toolkit process (evo-aftmand) on the Packet Forwarding Engine by driving continuous routing updates that produce unified-list (unilist) ECMP routes. The resulting internal state corruption generates an evo-aftmand-bx core and halts forwarding, requiring a manual FPC restart or system reboot to recover. No public exploit identified at time of analysis; the vendor (Juniper SIRT) notes successful exploitation depends on a sequence of events outside the attacker's direct control, so this is a high-CVSS availability issue rather than a trivially reproducible one.
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low-privileged authenticated attacker crash the Flexible PIC Concentrator (FPC) by subscribing over gRPC to an unsupported telemetry sensor path in the packet forwarding engine. Each crash produces a complete forwarding outage until the module auto-restarts, and the trigger can be repeated for sustained disruption. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low complexity and single low-privilege prerequisite make it operationally easy to trigger.
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exhaust the packet forwarding engine (PFE) by exploiting a race condition in stateful flow teardown. When the race is hit, a flow's timeout is mis-set to a very high value (>10,000s instead of 3s), so sessions are never reaped, invalidated sessions accumulate without bound, and the device eventually stops forwarding or hits a flowd core and reboots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is probabilistic because the triggering conditions are outside the attacker's control.
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker to exhaust packet-forwarding-engine memory and crash the Flexible PIC Concentrator (FPC). The flaw triggers only when sFlow monitoring is enabled in a Virtual Chassis and multicast traffic ingresses on one VC member and egresses on another, causing a slow buffer leak that culminates in an FPC crash and restart. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability risk for affected deployments.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated, network-based attacker to crash the flow processing daemon (flowd) by sending a malformed SIP INVITE packet when the SIP Application Layer Gateway (ALG) is enabled. The crash forces a flowd restart, producing a complete traffic-forwarding outage until the device auto-recovers, and can be repeated to sustain the outage. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. Because TCP proxy is engaged whenever ALGs, Advanced Anti-Malware, ICAP, or UTM services inspect a flow, exploitation forces a complete traffic-forwarding outage until the daemon auto-restarts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat to perimeter devices.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls lets an unauthenticated, network-based attacker crash and restart the PFE, dropping all traffic-forwarding services until automatic recovery. Exploitation is indirect: the attacker must lure or wait for the affected device to initiate an outbound TCP connection to an attacker-controlled system, which then replies with a crafted packet that trips an unhandled exceptional condition (CWE-754). Juniper-reported with CVSS 4.0 8.2; no public exploit identified at time of analysis and it is not in CISA KEV.
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate data-center links by injecting IPv6 multicast traffic in an EVPN-VxLAN fabric. When such packets reach a non-IRB interface of a spine switch, the packet-forwarding engine floods them to other spines and all ESI leaf switches, creating an endless forwarding loop that starves legitimate traffic. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 7.1.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauthenticated, Layer-2 adjacent attacker crash a line card by sending a single crafted packet within the same broadcast domain. The affected system miscalculates the packet size (CWE-1284, improper validation of specified quantity in input), which fails downstream processing and raises an MQSS major CMError that forces an automatic FPC reset, interrupting all traffic on that FPC until it recovers. Only deployments handling MAP-T or non-IP-over-IP traffic (e.g. MPLS over GRE) are exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Configuration injection in FastNetMon Community Edition through 1.2.9 allows an attacker who controls the attacker IP string passed to the Juniper integration plugin to inject arbitrary Juniper NETCONF set/delete commands, leading to full router compromise. The flaw lives in the PHP-based Juniper plugin where unsanitized argv input is interpolated into NETCONF commands, and although no public exploit identified at time of analysis (EPSS 0.03%), the technical impact is rated total under SSVC and CVSS scores 8.1.
OS command injection in FastNetMon Community Edition through 1.2.9 lets an authenticated network attacker execute arbitrary shell commands via the MikroTik router integration plugin by influencing argv[] values passed to the unsanitized _log() function. The flaw mirrors a previously disclosed Juniper plugin issue in the same project, and while a public technical write-up exists at lorikeetsecurity.com, no public exploit code or active exploitation has been identified, with EPSS at 0.05% (17th percentile).
OS command injection in FastNetMon Community Edition (through 1.2.9) lets attacker-controlled input reach an unescaped exec() call inside the Juniper router integration plugin, enabling arbitrary shell command execution on the host. The flaw lives in the _log() function of src/juniper_plugin/fastnetmon_juniper.php, where the $msg argument (built from argv[1]-argv[3]: attack IP, direction, power) is concatenated directly into a shell command. Although rated CVSS 9.8, practical exploitation is gated: FastNetMon's C++ core currently feeds IPs through inet_ntoa(), which only yields safe dotted-decimal strings, so injection requires the script to be driven directly or by a third-party orchestrator. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
BGP session reset vulnerability in Juniper Networks Junos OS 25.2 and Junos OS Evolved 25.2-EVO allows adjacent unauthenticated attackers to trigger Denial of Service by sending malformed BGP packets within established sessions. Affects both eBGP and iBGP implementations across IPv4 and IPv6. Repeated exploitation enables sustained service disruption. Vulnerability confirmed actively exploited (CISA KEV). No public exploit identified at time of analysis. Adjacent network access required; attacker must be on same network segment as BGP peering.
Command injection in Juniper Networks Junos OS and Junos OS Evolved CLI processing allows high-privileged local attackers to execute arbitrary shell commands as root through crafted 'set system' arguments, enabling complete system compromise. Affects all versions before multiple fixed releases across both operating systems. Authentication required (high-privileged local access). No public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS on SRX Series allows unauthenticated remote attackers to crash srxpfe process via malformed ICMPv6 packets during NAT64 translation. Repeated exploitation sustains DoS by forcing continuous process restarts. Affects wide range of Junos OS versions from 21.2 through 25.2 on SRX hardware. Vulnerability limited to ICMPv6 traffic; IPv4 and standard IPv6 cannot trigger. No public exploit identified at time of analysis.
Full device takeover in Juniper Networks Support Insights Virtual Lightweight Collector (vLWC) before 3.0.94 via hardcoded default credentials. The vLWC software ships with an unchangeable initial password for a high-privileged account with no enforced password change during provisioning, enabling unauthenticated remote attackers to gain complete system control. CVSS v4.0 score 9.3 (Critical). No public exploit identified at time of analysis.
Complete persistent denial of service in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated, low-privilege network attackers to crash the evo-aftmand service with no automatic recovery. The vulnerability triggers when PCEP-provisioned colored SRTE policy tunnels with 32-bit ASN values (greater than 65,535) in the Originator ASN field are monitored via gRPC, causing permanent forwarding plane failure until manual system restart. Affects multiple versions through 25.2 release train. No public exploit identified at time of analysis.
Packet buffer allocation failure in Juniper EX4000 and QFX5000 Series switches allows adjacent unauthenticated attackers to cause persistent Denial of Service requiring manual device restart. Attack vector requires specific configuration: device configured as service-provider edge with L2PT enabled on UNI and VSTP enabled on NNI in VXLAN scenarios. Receiving VSTP BPDUs on UNI triggers buffer exhaustion, halting all traffic forwarding. Affects Junos OS 24.4 through 24.4R1, 25.2 through 25.2R1. No public exploit identified at time of analysis.
Remote denial-of-service in Juniper Networks Junos OS (SRX/MX Series) allows unauthenticated attackers to crash IPsec daemons via malformed ISAKMP packets. Exploiting the improper input validation (CWE-1286) in kmd/iked IPsec library causes process restart, preventing new VPN security association establishment. Repeated attacks create sustained inability to establish VPN connections, severely degrading network connectivity for affected enterprise firewalls and routing platforms. No public exploit identified at time of analysis.
Juniper Networks CTP OS 9.2R1 and 9.2R2 fail to persist password complexity settings, enabling unauthenticated attackers to exploit predictable weak passwords on local accounts. The password management function allows administrators to configure complexity requirements but does not save these configurations, verifiable through 'Show password requirements' menu. This defect permits trivial passwords that attackers can brute-force remotely to gain full device control. No public exploit identified at time of analysis.
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Memory exhaustion in Juniper Networks Junos OS BroadBand Edge subscriber management daemon (bbe-smgd) on MX Series allows adjacent unauthenticated attackers to trigger persistent denial of service by sending authentication packets that do not match configured packet-type options. Each mismatched packet leaks memory, eventually consuming all available daemon heap memory and preventing new subscriber logins. Authentication packet-type configuration must be active for exploitation. No public exploit identified at time of analysis.
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services on MX Series routers. Each DHCPv6 subscriber logout in PPPoE or VLAN configurations with active/bulk lease query leaks memory, eventually exhausting resources and triggering jdhcpd crash. Service remains unavailable until process restart completes. Affects all Junos OS versions before 22.4R3-S1, 23.2 versions before 23.2R2, and 23.4 versions before 23.4R2. No public exploit identified at time of analysis.
Memory leak in Juniper Networks l2ald daemon allows adjacent attackers to crash Layer 2 services on EVPN-MPLS networks. Affects Junos OS and Junos OS Evolved across multiple versions. Unauthenticated attackers on the same network segment can trigger resource exhaustion by causing ESI route churn from multi-homed Provider Edge devices, forcing l2ald process crash and restart. No public exploit identified at time of analysis, but exploitation requires only network adjacency without authentication.
Symbolic link manipulation in Juniper Networks Junos OS CLI enables authenticated local attackers with low privileges to escalate to root access. Exploitation requires two users: the first performs a 'file link ...' CLI operation, then after the second user commits unrelated configuration changes, the first user can authenticate as root, achieving full system compromise. Affects Junos OS versions across 23.2, 23.4, 24.2, 24.4, and 25.2 release trains prior to specified patch levels. No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated users with low privileges to gain high-privileged direct access to Flexible PIC Concentrators (FPCs), enabling potential full compromise of affected line cards. Impacts PTX10004, PTX10008, PTX10016 with JNP10K-LC1201 or JNP10K-LC1202 line cards across multiple firmware branches. Missing authentication on critical FPC management functions permits unauthorized privilege elevation. No public exploit identified at time of analysis.
Management daemon deadlock in Juniper Networks Junos OS 23.4-24.4 and Junos OS Evolved enables network-based authenticated attackers to trigger complete management plane denial-of-service via rapid NETCONF session cycling. Vulnerability causes mgd processes to hang in lockf state, exhausting process pool and preventing administrative logins. Recovery requires device power-cycle. Affects deployments using NETCONF management interface with authenticated remote users. No public exploit identified at time of analysis.
Command injection in Juniper Networks Support Insights Virtual Lightweight Collector (JSI vLWC) CLI enables local high-privileged attackers to escalate privileges to root. Inadequate input validation in the CLI menu permits shell command injection, with injected commands executing at root level. All JSI vLWC versions before 3.0.94 affected. CVSS 8.4 (High severity, local vector). Requires high-level existing privileges (PR:H). No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users to execute arbitrary code with root privileges. When unsigned Python operation scripts are enabled in device configuration, attackers can inject and execute malicious op scripts under root-equivalent context, achieving complete system compromise. Affects all Junos OS versions before 22.4R3-S7 and multiple branches through 24.4, plus corresponding Junos OS Evolved releases. No public exploit identified at time of analysis. CVSS 8.5 (High) with local attack vector requiring low privileges and no user interaction.
Incorrect permission assignment on critical resources in Juniper Networks On-Box Anomaly detection framework. Allows unauthorized modification of anomaly detection configuration, potentially disabling security monitoring.
Denial-of-service attacks against Juniper SRX Series devices running Junos OS 23.4 through 24.4 can be triggered remotely by sending a maliciously crafted DNS request, causing the flowd process to crash and interrupt service until recovery completes. The vulnerability stems from an unchecked return value in the DNS module that allows unauthenticated, network-based attackers to exploit DNS-enabled SRX configurations without any user interaction. No patch is currently available for affected versions.
Juniper Networks Junos OS on SRX and MX Series is vulnerable to a double free condition in the flow processing daemon that an unauthenticated network attacker can trigger via a specific TCP packet sequence, causing the daemon to crash and the Fabric Routing Card to restart. This denial-of-service vulnerability affects all versions before 22.4R3-S7, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S4, and 24.2 before 24.2R2, with no patch currently available. An attacker on the network can exploit this vulnerability without authentication or user interaction to disrupt service availability.
Malformed SSL packets can trigger a Denial-of-Service condition in Juniper SRX devices running Junos OS with UTM Web-Filtering enabled, causing Forwarding Processor Card (FPC) crashes and restarts without requiring authentication. An unauthenticated network-based attacker can exploit this input validation flaw in the Web-Filtering module to disrupt device availability across affected Junos versions (23.2R2-S2 through 24.4R2). No patches are currently available for earlier Junos versions, and affected systems remain vulnerable until updates are applied.
Juniper SRX Series devices are vulnerable to denial-of-service attacks when processing malformed GTP Modify Bearer Request messages, which trigger an improper lock condition that freezes packet processing threads and causes watchdog timeouts. An unauthenticated network attacker can exploit this without user interaction to crash the forwarding processor and cause complete traffic outages requiring device restart. No patch is currently available for affected Junos OS versions.
Unauthenticated network-based attackers can cause a denial of service on Juniper EX4000-48T, EX4000-48P, and EX4000-48MP switches by sending high-volume traffic that crashes the FXPC component and forces a device restart. The vulnerability stems from improper resource initialization in the Internal Device Manager and results in complete service outage until automatic recovery completes. Affected versions include Junos OS 24.4 before 24.4R2 and 25.2 before 25.2R1, with no patch currently available.
Juniper Junos OS and Junos OS Evolved contain a use-after-free vulnerability in the 802.1X authentication daemon that allows authenticated, network-adjacent attackers to crash the process or achieve arbitrary code execution as root by triggering specific port state changes. Exploitation requires precise timing of a change-of-authorization event during port transitions, making reliable exploitation difficult but possible. Systems with 802.1X port-based network access control enabled are affected, and no patch is currently available.
A NULL pointer dereference in the routing protocol daemon (RPD) of Juniper Networks Junos OS and Junos OS Evolved lets a configured BGP peer crash the routing process by sending a BGP UPDATE when an import policy using `then source-based-forwarding next-hop next-table <X>` points at a routing table that does not exist. Exploitation is unauthenticated per the CVSS vector (PR:N) and network-reachable (AV:N), but it requires two non-default preconditions: the specific source-based-forwarding import policy misconfiguration, and an established, operator-sanctioned BGP peering session - both of which materially narrow real-world exposure. There is no public exploit identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); impact is availability-only, with a daemon crash that can ripple into network reachability.
An integer underflow in the srxpfe forwarding-plane daemon of Junos OS and Junos OS Evolved on SRX Series firewalls allows an unauthenticated attacker on an adjacent network segment to trigger a denial of service by sending an ICMP message tied to an SVR (Secure Vector Routing) carrier session. Affected deployments are those running SVR/carrier-session functionality on SRX platforms, where successful exploitation degrades or halts packet forwarding; the CVSS 4.0 base score of 7.1 reflects high availability impact with no confidentiality or integrity loss (assessed CVSS 3.1: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no public exploit code and no confirmed active exploitation (no CISA KEV listing) at time of analysis, but the attack requires only Layer 2 adjacency and no credentials or user interaction, so any SRX device with SVR sessions reachable from an untrusted adjacent segment should be treated as exposed.
Denial of service in Juniper Networks SRX Series firewalls running Junos OS in a chassis-cluster (high-availability) configuration allows an adjacent attacker to crash the data plane by sending crafted traffic over the chassis-cluster fabric interconnect. The flaw is a signed-to-unsigned conversion error (CWE-195) in the srxpfe packet forwarding engine; authentication requirements are confirmed as unauthenticated (PR:N) and no user interaction is needed (UI:N) once the attacker has a position on the fabric. There is no public exploit identified at time of analysis and no record of confirmed active exploitation (CISA KEV), and the attack surface is restricted to clustered deployments rather than general network exposure, making this an access-constrained availability threat.
Malformed firewall-authentication synchronization traffic delivered over a chassis-cluster fabric link can trip a reachable assertion in the srxpfe process on Juniper Networks SRX Series devices running Junos OS, aborting the packet forwarding engine and causing a denial of service of the data plane for traffic traversing the cluster. Exposure is limited to SRX platforms deployed in chassis-cluster high-availability configurations where firewall-authentication synchronization is in use; standalone SRX devices and clusters that do not use that synchronization mechanism are unaffected, and the attacker must already have a position on the normally dedicated point-to-point fabric interconnect (logically adjacent, with no authentication or user interaction required per the assessed vectors). At the time of analysis no public exploit code and no confirmed active exploitation were identified; the CVSS 4.0 base score is 7.1 with availability-only impact (VC:N/VI:N/VA:H), and the vendor advisory is Juniper JSA112186.
A heap-based buffer overflow in the eventd daemon of Juniper Networks Junos OS and Junos OS Evolved allows a local unprivileged attacker to send crafted IPC messages, leading to denial of service or privilege escalation to root. The vulnerability affects all platforms and carries a CVSS 4.0 base score of 8.6 due to high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis; exploitation requires a pre-existing local account or foothold on the device, and network-based unauthenticated attacks are not possible.
Juniper Networks Junos OS and Junos OS Evolved can be forced into a denial of service by a network-adjacent, already-established BGP peer that drives the routing protocol daemon (rpd) into a reachable assertion (CWE-617) by triggering a specific code path in labeled-unicast processing when the non-default 'aggregate-label' labeled-unicast setting is configured. Impact is confined to availability - the rpd process crashes and must restart, causing route churn and potential traffic loss - with no confidentiality or integrity exposure; the assessed vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects that the attack surface is a configured BGP peering relationship rather than an arbitrary remote host, so this is a genuine but conditional priority rather than an inflated high-CVSS issue. No public exploit identified at time of analysis, and exploitation additionally requires both the aggregate-label configuration and an existing BGP session with the target device.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to crash or destabilize the routing daemon (rpd) by sending a specially crafted IS-IS SRv6 packet, disrupting routing on the affected device. Exploitation is tightly constrained: the device must have both SRv6 and Flexible Algorithm explicitly enabled in its IS-IS configuration (a non-default segment-routing setup), and the attacker must already sit on an adjacent network segment able to inject IS-IS packets into the routing domain - a remote Internet attacker cannot reach this path. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (not in CISA KEV); with an assessed CVSS:3.1 base of AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (vendor score 7.1 under CVSS 4.0), it is a moderate-priority, availability-only issue whose real-world exposure is narrowed by its configuration prerequisites and adjacency requirement.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved occurs when an unauthenticated adjacent attacker who is an established LDP peer sends crafted LDP messages, triggering a NULL pointer dereference in the routing protocol daemon (rpd) that can crash the daemon. The flaw is availability-only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and requires MPLS with LDP configured and an operational LDP session; default configurations without MPLS/LDP are not exploitable. No public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
A crafted LDP message sent by a compromised LDP neighbor can trigger a reachable assertion failure that crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial-of-service condition on the affected device. Only devices with LDP/MPLS actively configured are exposed, and the attacker must already control a device that holds an established LDP adjacency with the target, so the CVSS 4.0 vector (7.1) is scored AV:A - adjacent network, not internet-reachable. Impact is availability-only: no confidentiality or integrity effect, with no confirmed actively exploited campaigns (not in CISA KEV) and no public exploit code identified at time of analysis; this is a moderate-priority availability issue rather than a top-tier emergency.
Remote code execution (on Junos OS) and rpd denial of service (on Junos OS and Junos OS Evolved) result from a stack-based buffer overflow in Juniper Networks routing protocol daemon (rpd). A remote configured BGP peer can trigger it by sending a flow-spec update that is selected for re-advertisement; exploitation requires an existing BGP peering relationship and the relevant flow-spec re-advertisement configuration. Rated Critical (CVSS 4.0 base 9.3), Junos OS can be compromised for code execution while Junos OS Evolved is limited to an rpd crash, and no public exploit identified at time of analysis.
A malformed BGP VPLS signaling update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service on the affected device. The flaw is improper input validation (CWE-20) in rpd's handling of BGP signaling messages; the attack vector is adjacent and the CVSS 4.0 vector carries PR:N (no privileges required), but successful exploitation requires the target to be running BGP with VPLS signaling configured and to already have an established peering relationship with the attacking peer. Impact is limited to availability (rpd restart, routing churn, potential traffic loss) with no confidentiality or integrity impact; no public exploit code has been identified and there is no KEV confirmation of active exploitation at time of analysis, so this is a genuine but bounded operational risk rather than an urgent emergency.
An adjacent eBGP peer can crash the Juniper Junos OS and Junos OS Evolved routing protocol daemon (rpd) by sending a crafted VPLS signaling update, but only on routers where VPLS automatic site-ID negotiation is enabled and an external BGP peering session is already established. The flaw is a reachable assertion (CWE-617) in rpd that terminates the process, producing a denial of service with no confidentiality or integrity impact; Juniper rates it 7.1 under CVSS 4.0, and our independent assessment scores it CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, treating it as a moderate-priority availability issue rather than an emergency. No public exploit code has been identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing), so risk is concentrated in networks that combine external BGP peering with non-default VPLS auto site-ID negotiation.
Malformed ICCP messages sent to the l2ald daemon in Juniper Networks Junos OS and Junos OS Evolved can disclose process heap memory or crash the daemon, producing a denial-of-service condition. Only devices configured for MC-LAG with ICCP between chassis are exposed, and the attacker must already control or impersonate a configured ICCP peer, i.e. occupy or spoof a trusted position on the inter-chassis control link (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, 7.1). Exploitation is not possible against a default configuration or from the general internet, and no public exploit identified at time of analysis.
Juniper Networks Junos OS and Junos OS Evolved devices configured for MC-LAG with ICCP can be disrupted by an adjacent, unauthenticated attacker who sends an inconsistent ICCP peer message that triggers a reachable assertion in the l2ald daemon. Successful exploitation results in a denial of service affecting availability, with no confidentiality or integrity impact; no public exploit was identified at time of analysis, and the attack is limited to environments that have the non-default MC-LAG/ICCP redundancy feature enabled and where the attacker can reach the ICCP peer relationship at Layer 2.
Crashing the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved is possible via a malformed BGP MCAST-VPN update sent from a configured eBGP peer, resulting in a denial-of-service condition. Exploitation is gated: the target must have the BGP multicast-VPN (MVPN) address family active and an established eBGP peering relationship, so realistic attackers are limited to peering or adjacent networks rather than the general internet. No public exploit code or confirmed active exploitation exists at time of analysis, and the vendor advisory (JSA112187) should be consulted for patch availability.
Denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent, unauthenticated attacker to disrupt or crash RSVP processing by sending a malformed RSVP packet to an interface where RSVP is explicitly enabled. Exploitation is conditional: RSVP is not enabled by default and is only present in MPLS traffic-engineering/signaling deployments, and the attacker must have Layer-2 or directly-reachable adjacency to the affected interface (CVSS AV:A, PR:N, UI:N), so routers without RSVP configured are not exposed. Impact is availability-only with no confidentiality or integrity exposure; vendor CVSS is 7.1, and no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
An unauthenticated attacker with an adjacent network position can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved devices by sending a specifically crafted RSVP packet, producing a denial of service on affected routing platforms. The flaw is a reachable assertion (CWE-617) that only triggers when RSVP signaling is enabled - i.e., devices running MPLS RSVP-TE within rpd - so unconfigured devices are not on the vulnerable path, and no data confidentiality or integrity impact is involved. As of analysis, there is no CISA KEV listing and no public exploit identified at time of analysis; vendor patches are available, and the real-world risk is tempered by the adjacency and RSVP-configuration prerequisites, making this a moderate rather than top-priority issue.
Heap-based buffer overflow in Juniper Networks Junos OS on SRX Series devices that have Secure Vector Routing (SVR) enabled allows unauthenticated remote attackers to cause a denial of service and potentially compromise confidentiality and integrity via malformed IPv4 packets. Exploitation requires the target device to have at least one interface explicitly configured for SVR, a non-default feature; devices without SVR are not exposed. At time of analysis, no public exploit code has been identified, but the flaw carries a critical severity rating (CVSS 9.3) and should be prioritized for patching on affected deployments.
A stack-based buffer overflow (CWE-121) in the UTM Anti-Spam SBL inspection component of Juniper Networks Junos OS on SRX series firewalls lets an unauthenticated, remote attacker achieve arbitrary code execution or a denial of service by injecting a malformed DNS packet into the device's SBL lookup flow. Exploitation is gated by two real-world preconditions: the non-default UTM Anti-Spam SBL feature must be explicitly enabled, and the attacker must be positioned to inject or spoof the DNS response the device consumes (reflected by the CVSS 4.0 AT:P attack-requirements metric) - which is why the vendor's 9.2 score is tempered by our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Remote code execution as root in Juniper Networks Junos OS on SRX Series allows unauthenticated network-based attackers to execute arbitrary code via a SQL injection flaw in the ipfd process, but exploitation requires that the SRX device be configured with a Security Intelligence (SecIntel) feed connection. This high-severity vulnerability (CVSS 4.0 base score 9.2) has no public exploit identified at time of analysis. Devices without SecIntel configured are not exposed.
Root-level code execution is possible on Juniper SRX Series devices running Junos OS, because the ipfd daemon passes externally supplied data retrieved from a configured HTTPS feed server into a formatted-output function, allowing the feed server to inject format specifiers that corrupt memory and hand the attacker code execution as root (CWE-134, CVSS 4.0 base 9.2). The flaw is unauthenticated with no user interaction (PR:N/UI:N), but the CVSS 4.0 vector carries AT:P because two prerequisites must hold: the SRX device must actually be configured to consume an HTTPS feed source, and the attacker must either compromise or impersonate that feed server, which is why the independent assessment maps the issue to CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H rather than treating it as a default-configuration remote takeover. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, so a default, feed-less SRX configuration is not directly reachable by arbitrary internet attackers; the risk concentrates on deployments that actively pull external feeds.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
OS command injection in the Junos OS CLI lets an authenticated, low-privileged local user escalate to full root control of the device by passing unsanitized arguments to the 'request csds' operational command. Only Junos OS 24.4 (from 24.4R1 up to before 24.4R2-S4), 25.2 (before 25.2R2-S1), and 25.4 (before 25.4R1-S3) are affected; releases before 24.4R1 are explicitly unaffected, and the attack is strictly local with no network or unauthenticated path. There is no public exploit identified at time of analysis, and Juniper has released fixed versions (24.4R2-S4, 25.2R2-S1, 25.4R1-S3), making this a serious but access-gated issue rather than an internet-facing emergency.
Sustained high connections-per-second churn can drive a per-session memory leak in the packet forwarding engine (PFE) of Juniper Junos OS, exhausting PFE memory and causing a complete denial of service on SRX4000 Series, SRX5000 Series with SPC3, and MX Series with SPC3. The flaw is reachable by unauthenticated, network-based remote attackers (CVSS vector includes PR:N/UI:N, so no credentials or user interaction are required), but only on devices where at least one application service such as ALGs, IDP/DPI, APPID, SECINTEL, AAMW, or AppQoE is actually configured. Affected releases are 23.4 from 23.4R2-S3 before 23.4R2-S7, 24.2 from 24.2R2 before 24.2R2-S3, 24.4 before 24.4R2-S3, and 25.2 before 25.2R1-S2/25.2R2; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV).
A network-based, unauthenticated attacker can cause a temporary denial of service on Juniper Networks SRX Series devices running Junos OS when the SSL proxy feature is enabled. During a TLS session-resumption attempt, a specifically malformed TLS message triggers an improper handling of a missing special element in the SSL plugin, leading to an invalid pointer access and a Packet Forwarding Engine (PFE) crash that interrupts traffic forwarding until the PFE automatically recovers. Exploitation is conditional: it requires the non-default 'ssl-proxy' configuration, and the exact internal timing needed to hit the fault is outside the attacker's direct control, making the attack probabilistic rather than reliably repeatable; no public exploit identified at time of analysis and there is no impact to confidentiality or integrity, only availability. Vendor-released patches are available in the fixed Junos OS releases listed in advisory JSA112176.
Denial of service in Juniper Networks Junos OS on SRX Series firewalls with UTM WebFiltering enabled allows unauthenticated, network-based attackers to crash and restart the UTM subsystem, knocking out all UTM-served traffic until the device recovers. The crash is not directly reachable: it requires the external WebFiltering cloud categorization server to be unreachable so that category-lookup requests accumulate, plus sustained HTTP load and a specific timing window during cleanup of those pending lookups that drives the process into an invalid internal state (CWE-413, improper resource locking); both NextGeneration WebFiltering (NGWF) and Enhanced WebFiltering (EWF) are affected. Junos OS 23.2R2, 23.4R2, 24.2, 24.4, 25.2 and 25.4 branches are impacted below their respective fixed releases, the vendor rates this CVSS 4.0 base 8.2, and no public exploit identified at time of analysis. Because of the cloud-server-unreachable precondition and the load/timing race, the independent assessment classifies this as a genuine availability risk rather than a drop-everything emergency.
Remote code execution in Juniper Networks Junos OS on SRX Series devices configured for AutoDiscovery VPN (ADVPN) can let an attacker who already is a trusted ADVPN peer take complete control of the device via malformed ADVPN attributes that trigger a buffer overflow. Exploitation requires the attacker either to possess the ADVPN pre-shared secret to impersonate a peer or to have compromised a legitimate peer, and the independent assessment rates this as high severity but not an emergency despite the 9.2 CVSS 4.0 score. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can cause a complete denial-of-service (FPC crash) in Juniper Junos OS on SRX Series by exploiting a NULL pointer dereference in the DNS plugin when multiple DNS queries in a single flow session trigger both Security Intelligence (SecIntel) feed matching and Domain Generation Algorithm (DGA) analysis. Exploitation requires a non-default configuration where both SecIntel and DGA features are enabled, and the crash depends on a timing/race condition that the attacker cannot directly control, limiting reliability. No public exploit code has been identified at time of analysis, and vendor patches are available.
Denial-of-service in Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to crash the routing protocol daemon (rpd) on an affected device that is deployed in a BGP traffic-engineering scenario, simply by delivering a single valid, optional, non-transitive BGP update over an already-established BGP session. The crash triggers an automatic rpd restart, so the impact is a temporary loss of routing and forwarding until the control plane reconverges rather than persistent compromise, and exploitation is practical only for an adjacent BGP peer or an attacker able to inject into an existing session - arbitrary internet-based exploitation is not possible. Affected releases include all Junos OS versions before 23.2R2-S6 as well as the 23.4, 24.2, 24.4 and 25.2 branches, plus the corresponding Junos OS Evolved releases; vendor patches are available via JSA112168, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at the time of analysis.
Unauthenticated remote code execution with elevated privileges is possible in Juniper Junos OS and Junos OS Evolved through the J-Web management interface. An attacker who can reach J-Web can send a crafted HTTP request to bypass authentication and execute CGI content with high confidentiality, integrity, and availability impact; the CVSS v4 base score is 9.3 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified at time of analysis, and the primary risk factor is exposure of J-Web to untrusted or internet-facing networks, since devices with J-Web disabled or restricted to a management network are not reachable.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved (rpd) allows a configured BGP peer to crash or disrupt the routing protocol daemon by sending a specifically malformed BGP MCAST-TREE update that is then attempted to be re-advertised. The vulnerability affects numerous Junos OS and Junos OS Evolved versions below the fixed releases listed in Juniper advisory JSA112187, with a CVSS v4.0 score of 8.7. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires the attacker to be an established BGP peer and the target to participate in BGP multicast routing.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
A malformed BGP-signaled SRv6 service route can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, causing a denial of service that disrupts routing on the affected device. The issue is remotely triggerable with no credentials or user interaction (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N, VA:H), scoring 8.7, but it is conditional: exploitation requires that SRv6 dynamic tunnels be explicitly enabled (a non-default configuration) and that the attacker already hold an established BGP peering session with the target. Impact is limited to availability of the routing daemon - there is no confidentiality or integrity impact - and no public exploit has been identified at time of analysis. All software versions enumerated by the vendor are unpatched; Juniper has released fixed builds.
Malformed OSPF packets crafted by an adjacent OSPF peer can crash the Juniper Networks Junos OS rpd routing daemon or disclose portions of its process memory, affecting both Junos OS and Junos OS Evolved builds below the fixed releases enumerated in JSA112187 (for example Junos OS prior to 23.2R2-S7.7, 24.2R2-S5.5 and 25.2R2-S2, and the corresponding -EVO builds). The weakness is an unauthenticated adjacent attack (CVSS v4.0 base 7.1, AV:A/PR:N/UI:N with high availability and low confidentiality impact), meaning the attacker must already hold or establish OSPF adjacency on the same routing segment, so exposure is confined to devices actively running OSPF rather than the general internet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are already available, making this a moderate-priority routing-infrastructure issue rather than a mass-exploitation emergency.
Crafted RSVP packets can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, producing a denial of service on devices where non-default Layer 2 label-switched path (L2 LSP) RSVP signaling is enabled. The issue is an adjacent-network, unauthenticated attack (CVSS v4.0 7.1, AV:A/AC:L/PR:N/UI:N, availability-only impact, and our independent assessment concurs with CVSS:3.1 AV:A/AC:L/PR:N/UI:N/A:H): the attacker must sit on the same Layer 2 segment as the target but needs no credentials and no user interaction, and a single malformed packet is sufficient. No public exploit code exists and there is no confirmed active exploitation at time of analysis, and the practical exposure is bounded because L2 LSP support is a non-default configuration; Juniper advisory JSA112187 provides patched releases.
A crafted BGP FlowSpec update delivered over an established peering session crashes the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking the device's control plane and routing functionality offline until rpd recovers. Affected release trains include Junos OS before 25.2R2-S2, 25.4R1-S3 and 26.2R1-S2, plus the corresponding Junos OS Evolved builds and the Evolved 23.4X100, 25.2X100 and 25.4X300 trains. The mechanics of the trigger are simple and require no credentials beyond a BGP session that carries the FlowSpec address family, but exploitation is gated by that peering prerequisite; there is no public exploit code identified at time of analysis and no confirmed active exploitation, and Juniper has published fixed builds under advisory JSA112187.
Persistent routing-daemon denial of service affects Juniper Networks Junos OS and Junos OS Evolved: a single specially crafted BGP packet crashes rpd (NULL pointer dereference, CWE-476) when the device is running with ephemeral configuration in use, and the targeted router must already have the sending device established as an eBGP peer. The CVSS 4.0 base score is 8.7 with PR:N, i.e. no authentication is required from the network perspective, but exploitation is bounded by two real prerequisites - an existing BGP peering/trust relationship and the ephemeral-configuration feature being active - so routers that do not peer with the attacker or that do not use ephemeral configuration are not exposed. Impact is availability only (rpd restart/crash cycle with no confidentiality or integrity loss); there is no public exploit identified at time of analysis, and CISA KEV does not list this issue. A vendor fix is available.
Unauthenticated remote code execution with root privileges affects Juniper Networks Junos OS devices that expose the J-Web web management interface. An attacker who can reach the J-Web HTTP/HTTPS interface can bypass authentication due to an improper authentication flaw (CWE-287) and execute arbitrary Junos commands as root, with no credentials or user interaction required. The CVSS 4.0 score is 9.3 and our independent CVSS 3.1 assessment is 9.8; no public exploit code has been identified at time of analysis, but exposure is critical for any internet-facing or broadly reachable J-Web service.
Integer underflow in the Junos OS kernel can crash a device when the Extended Echo feature (RFC 8335 ICMP probing) is configured, allowing a remote, unauthenticated attacker to cause a denial of service; the independent assessment rates the impact as availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The exposure is bounded by the Extended Echo precondition, and no public exploit identified at time of analysis. Juniper advisory JSA112188 should be used to identify affected and fixed releases.
A stack-based buffer overflow in the Juniper Networks Junos OS dot1x daemon lets a network-adjacent attacker who is acting as the configured ICCP peer crash the daemon and potentially execute code as root - but only on devices operating as Junos Fusion Aggregation Devices with dot1x synchronization enabled for the required Fusion satellite topology. The flaw carries a CVSS 4.0 score of 8.7 with high confidentiality, integrity and availability impact; the vector is PR:N and AC:L, although in practice the attacker must hold a trusted position on the ICCP control fabric rather than obtain arbitrary remote access, and devices not running the Fusion aggregation role with dot1x sync are not exposed. No public exploit code and no confirmed active exploitation were identified at the time of analysis, so this remains a genuinely serious issue for affected deployments but a narrow one in practice.
Denial of service against the Two-Way Active Measurement Protocol (TWAMP) client in Juniper Networks Junos OS allows an unauthenticated, network-positioned attacker to crash the rmopd service by sending a single specially crafted TCP packet. Only devices on which the TWAMP client feature is configured are exposed, since the faulty code path lives in that client; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor-scored 9.2 under CVSS 4.0) confirms no authentication, privileges, or user interaction are required once the feature is enabled, and impact is confined to availability with no confidentiality or integrity effect. No public exploit identified at time of analysis, and no CISA KEV entry accompanies this advisory; the realistic risk is driven by the non-default nature of the TWAMP configuration rather than by broad internet-scale exposure.
A NULL pointer dereference in the pkid (PKI daemon) component of Juniper Networks Junos OS can be triggered by a malformed packet delivered during CMP (Certificate Management Protocol) enrollment or automatic certificate re-enrollment, causing the affected daemon to crash and producing a denial-of-service condition. The flaw is remotely reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) and affects numerous Junos OS trains including 23.2, 23.4, 24.2, 24.4, 25.2, 25.4, and 26.2 below their respective fixed maintenance releases; impact is confined to availability, with no confidentiality or integrity loss. Exploitation is conditional on the target device actually being in a CMP enrollment or re-enrollment exchange at the time the malformed packet arrives, so devices not configured for CMP-based certificate provisioning are not exposed via this vector, and no public exploit code was identified at time of analysis.
Denial of service in Juniper Networks Junos OS arises from improper handling of highly compressed data (CWE-409) in the gRPC library used by the na-grpcd daemon, letting an attacker who can reach that interface crash or exhaust it with a crafted compressed gRPC request. Exploitation requires network reachability to na-grpcd plus valid low-level credentials (CVSS 4.0 scores this 7.1; independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so it is not reachable by fully unauthenticated attackers under default posture. Affected are Junos OS trains below the vendor's fixed maintenance releases (for example 23.2R2-S7.7, 24.2R2-S5.5, 24.4R2-S5, 25.2R2-S2, 25.4R1-S3, 26.2R1-S2); no public exploit identified at time of analysis, and impact is confined to availability of the targeted service with no confidentiality or integrity loss.
A heap-based buffer overflow in the VXLAN Gateway Daemon (vgd) of Juniper Networks Junos OS allows an attacker who controls (or has compromised) the SDN controller to crash the OVSDB control plane - a complete denial of service of the EVPN/VXLAN control path - and possibly achieve remote code execution on the gateway device. The flaw is remotely reachable from the adjacent control/management network (CVSS 4.0 8.7, AV:A/PR:N), meaning no authentication is required per the published vector, though exploitation is conditional: the device must be deployed as a VXLAN/EVPN gateway with the OVSDB control plane enabled and managed by an external SDN controller, which is not a default configuration. Vendor patches are available and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Crashing the Junos OS routing protocol daemon (rpd) on MX Series routers is possible for unauthenticated attackers on an adjacent network who can deliver a crafted eBGP route update, but only when hierarchical fast reroute (HFRR) link protection is configured inside a VRF or routing instance. Impact is confined to availability - rpd hits a reachable assertion and aborts, producing a routing-level denial of service - with no confidentiality or integrity exposure, and the adjacent-network vector plus the non-default HFRR-in-VRF prerequisite and MX-only scope bound the overall risk. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available from Juniper.
An authenticated format-string vulnerability in the gRPC daemon that backs the gNMI service on Juniper Networks Junos OS Evolved lets a network attacker who holds valid low-privileged credentials feed crafted format specifiers into a telemetry code path, with potential outcomes ranging from telemetry-service disruption and information disclosure up to root-level code execution. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is remote but requires an authenticated session against an enabled, network-reachable gNMI interface - it is not reachable by a fully anonymous attacker. At the time of analysis there is no CISA KEV entry and no public exploit code identified, and the vendor has published advisory JSA112250; this is a credible priority for organizations running Evolved with gNMI exposure, but not a drop-everything emergency on the available signals.
Unauthenticated OS command injection in Juniper Networks Junos OS Evolved's bootzd zero-touch provisioning (ZTP) daemon allows adjacent attackers on the management LAN to execute arbitrary commands as root via a crafted DHCP response. The vulnerability has a CVSS 4.0 base score of 9.3 and requires the target device to be actively in ZTP mode; no public exploit code is identified at time of analysis.
A stack-based buffer overflow in the kernel of Juniper Networks Junos OS Evolved can be triggered by a crafted TCP packet when key-chain authentication is configured for BGP or LDP sessions, leading to a kernel panic and denial of service. This remotely exploitable, unauthenticated vulnerability requires network reachability to BGP (TCP/179) or LDP (TCP/646) and the operator-side configuration of key-chain authentication for those protocols. No public exploit code or active exploitation has been identified at time of analysis; the assessed impact is limited to denial of service with no confidentiality or integrity impact, and it is not a code-execution threat.
An out-of-bounds write in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on QFX5240, QFX5241, and QFX5250 switches configured for BGP global-load-balancing with more than 128 ECMP next-hops allows unauthenticated adjacent-network attackers to crash rpd, causing a denial of service. This moderate-severity (CVSS 6.5) flaw is availability-only; exploitation requires the specific hardware and non-default routing configuration, and no public exploit code has been identified at time of analysis. Devices not configured for BGP global-load-balancing or with 128 or fewer ECMP next-hops are not affected.
Unauthenticated OS command injection in the bootzd zero-touch provisioning (ZTP) daemon of Juniper Networks Junos OS Evolved on PTX Series routers allows an attacker positioned on the management LAN to execute arbitrary commands as root by sending a crafted gRPC response to a device that is actively provisioning. The vulnerability carries a CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting low attack complexity, no authentication or user interaction requirements, and full confidentiality, integrity, and availability impact; the adjacent-network attack vector (AV:A) means the device is not exploitable directly from the internet. No public exploit code has been identified at time of analysis, no CISA KEV listing or EPSS score was provided, and exposure is materially reduced where management traffic runs over a segmented or physically isolated out-of-band network and where devices are not in an active ZTP state.
Unauthenticated adjacent IS-IS peers can cause a denial of service in the routing protocol daemon (rpd) of Juniper Networks Junos OS Evolved on PTX Series by sending crafted input that fails proper quantity validation (CWE-1284). This medium-severity flaw (CVSS 6.5, AV:A/PR:N/UI:N/A:H) requires the attacker to hold Layer 2 adjacency on a directly connected or shared broadcast segment; no authentication or user interaction is needed. No public exploit code has been identified at time of analysis.
Persistent telemetry dial-out denial of service in Juniper Networks Junos OS Evolved allows an attacker with management-plane access to the device's gNMI listener to crash or wedge the jti-dialoutd telemetry process by submitting a crafted analytics sensor resource that is consumed as a format string (CWE-134). Exploitation requires the gNMI listener to be reachable and enabled with telemetry/JTI dial-out configured, and Juniper's description characterizes the actor as authenticated; note that the published CVSS vector lists PR:N, which contradicts that authentication prerequisite and should be reconciled against Juniper advisory JSA112250. Impact is confined to loss of telemetry dial-out and analytics streaming rather than data-plane forwarding, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Remote denial-of-service in Juniper Networks Junos OS and Junos OS Evolved 25.2 (before 25.2R2 / 25.2R2-EVO) lets an adjacent, unauthenticated BGP peer crash the routing protocol daemon (RPD) by sending a single malformed non-inet/inet6 unicast BGP update over an already-established session. The RPD crash-and-restart produces a full routing outage until reconvergence completes, though the crash occurs before the update is readvertised so there is no downstream propagation to other routers. CVSS 4.0 base score is 7.1; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in the Packet Forwarding Engine of Juniper Junos OS on MX Series routers allows an unauthenticated, network-adjacent attacker to crash and restart the FPC by continuously flapping Micro-BFD sessions. The PFEMAN process queues each up/down event and, in a Virtual-Chassis deployment with locality-bias enabled, processing is slow enough that a sustained flap backlog prevents completion and trips the PFEMAN watchdog timer, forcing an FPC restart and a full traffic outage. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the low complexity and unauthenticated adjacent vector make it a credible availability threat to affected line cards (MPC9 and below).
Denial-of-service in Juniper Junos OS Evolved on PTX Series routers lets an unauthenticated network attacker crash the advanced forwarding toolkit process (evo-aftmand) on the Packet Forwarding Engine by driving continuous routing updates that produce unified-list (unilist) ECMP routes. The resulting internal state corruption generates an evo-aftmand-bx core and halts forwarding, requiring a manual FPC restart or system reboot to recover. No public exploit identified at time of analysis; the vendor (Juniper SIRT) notes successful exploitation depends on a sequence of events outside the attacker's direct control, so this is a high-CVSS availability issue rather than a trivially reproducible one.
Denial-of-service in Juniper Networks Junos OS on EX Series switches (EX2300, EX3400, EX4000, EX4100, EX4400) lets a low-privileged authenticated attacker crash the Flexible PIC Concentrator (FPC) by subscribing over gRPC to an unsupported telemetry sensor path in the packet forwarding engine. Each crash produces a complete forwarding outage until the module auto-restarts, and the trigger can be repeated for sustained disruption. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low complexity and single low-privilege prerequisite make it operationally easy to trigger.
Denial-of-service in Juniper Networks Junos OS on SRX Series devices lets an unauthenticated, network-based attacker exhaust the packet forwarding engine (PFE) by exploiting a race condition in stateful flow teardown. When the race is hit, a flow's timeout is mis-set to a very high value (>10,000s instead of 3s), so sessions are never reaped, invalidated sessions accumulate without bound, and the device eventually stops forwarding or hits a flowd core and reboots. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is probabilistic because the triggering conditions are outside the attacker's control.
Denial-of-service in Juniper Junos OS on EX4100 and EX4400 Series switches allows an unauthenticated adjacent attacker to exhaust packet-forwarding-engine memory and crash the Flexible PIC Concentrator (FPC). The flaw triggers only when sFlow monitoring is enabled in a Virtual Chassis and multicast traffic ingresses on one VC member and egresses on another, causing a slow buffer leak that culminates in an FPC crash and restart. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability risk for affected deployments.
Denial-of-service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series devices allows an unauthenticated, network-based attacker to crash the flow processing daemon (flowd) by sending a malformed SIP INVITE packet when the SIP Application Layer Gateway (ALG) is enabled. The crash forces a flowd restart, producing a complete traffic-forwarding outage until the device auto-recovers, and can be repeated to sustain the outage. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Remote denial of service in Juniper Networks Junos OS on MX Series (with SPC3) and SRX Series firewalls lets an unauthenticated network attacker crash the flow processing daemon (flowd) by sending a single TCP packet with a malformed TCP header when the TCP proxy is active. Because TCP proxy is engaged whenever ALGs, Advanced Anti-Malware, ICAP, or UTM services inspect a flow, exploitation forces a complete traffic-forwarding outage until the daemon auto-restarts. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a credible availability threat to perimeter devices.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Junos OS on MX (with SPC3) and SRX-series firewalls lets an unauthenticated, network-based attacker crash and restart the PFE, dropping all traffic-forwarding services until automatic recovery. Exploitation is indirect: the attacker must lure or wait for the affected device to initiate an outbound TCP connection to an attacker-controlled system, which then replies with a crafted packet that trips an unhandled exceptional condition (CWE-754). Juniper-reported with CVSS 4.0 8.2; no public exploit identified at time of analysis and it is not in CISA KEV.
Denial-of-service in Juniper Networks Junos OS on QFX10000 Series switches allows an unauthenticated, adjacent (Layer 2) attacker to saturate data-center links by injecting IPv6 multicast traffic in an EVPN-VxLAN fabric. When such packets reach a non-IRB interface of a spine switch, the packet-forwarding engine floods them to other spines and all ESI leaf switches, creating an endless forwarding loop that starves legitimate traffic. No public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor-assigned CVSS 4.0 base score is 7.1.
Denial-of-service in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series routers lets an unauthenticated, Layer-2 adjacent attacker crash a line card by sending a single crafted packet within the same broadcast domain. The affected system miscalculates the packet size (CWE-1284, improper validation of specified quantity in input), which fails downstream processing and raises an MQSS major CMError that forces an automatic FPC reset, interrupting all traffic on that FPC until it recovers. Only deployments handling MAP-T or non-IP-over-IP traffic (e.g. MPLS over GRE) are exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Configuration injection in FastNetMon Community Edition through 1.2.9 allows an attacker who controls the attacker IP string passed to the Juniper integration plugin to inject arbitrary Juniper NETCONF set/delete commands, leading to full router compromise. The flaw lives in the PHP-based Juniper plugin where unsanitized argv input is interpolated into NETCONF commands, and although no public exploit identified at time of analysis (EPSS 0.03%), the technical impact is rated total under SSVC and CVSS scores 8.1.
OS command injection in FastNetMon Community Edition through 1.2.9 lets an authenticated network attacker execute arbitrary shell commands via the MikroTik router integration plugin by influencing argv[] values passed to the unsanitized _log() function. The flaw mirrors a previously disclosed Juniper plugin issue in the same project, and while a public technical write-up exists at lorikeetsecurity.com, no public exploit code or active exploitation has been identified, with EPSS at 0.05% (17th percentile).
OS command injection in FastNetMon Community Edition (through 1.2.9) lets attacker-controlled input reach an unescaped exec() call inside the Juniper router integration plugin, enabling arbitrary shell command execution on the host. The flaw lives in the _log() function of src/juniper_plugin/fastnetmon_juniper.php, where the $msg argument (built from argv[1]-argv[3]: attack IP, direction, power) is concatenated directly into a shell command. Although rated CVSS 9.8, practical exploitation is gated: FastNetMon's C++ core currently feeds IPs through inet_ntoa(), which only yields safe dotted-decimal strings, so injection requires the script to be driven directly or by a third-party orchestrator. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
BGP session reset vulnerability in Juniper Networks Junos OS 25.2 and Junos OS Evolved 25.2-EVO allows adjacent unauthenticated attackers to trigger Denial of Service by sending malformed BGP packets within established sessions. Affects both eBGP and iBGP implementations across IPv4 and IPv6. Repeated exploitation enables sustained service disruption. Vulnerability confirmed actively exploited (CISA KEV). No public exploit identified at time of analysis. Adjacent network access required; attacker must be on same network segment as BGP peering.
Command injection in Juniper Networks Junos OS and Junos OS Evolved CLI processing allows high-privileged local attackers to execute arbitrary shell commands as root through crafted 'set system' arguments, enabling complete system compromise. Affects all versions before multiple fixed releases across both operating systems. Authentication required (high-privileged local access). No public exploit identified at time of analysis.
Denial of service in Juniper Networks Junos OS on SRX Series allows unauthenticated remote attackers to crash srxpfe process via malformed ICMPv6 packets during NAT64 translation. Repeated exploitation sustains DoS by forcing continuous process restarts. Affects wide range of Junos OS versions from 21.2 through 25.2 on SRX hardware. Vulnerability limited to ICMPv6 traffic; IPv4 and standard IPv6 cannot trigger. No public exploit identified at time of analysis.
Full device takeover in Juniper Networks Support Insights Virtual Lightweight Collector (vLWC) before 3.0.94 via hardcoded default credentials. The vLWC software ships with an unchangeable initial password for a high-privileged account with no enforced password change during provisioning, enabling unauthenticated remote attackers to gain complete system control. CVSS v4.0 score 9.3 (Critical). No public exploit identified at time of analysis.
Complete persistent denial of service in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated, low-privilege network attackers to crash the evo-aftmand service with no automatic recovery. The vulnerability triggers when PCEP-provisioned colored SRTE policy tunnels with 32-bit ASN values (greater than 65,535) in the Originator ASN field are monitored via gRPC, causing permanent forwarding plane failure until manual system restart. Affects multiple versions through 25.2 release train. No public exploit identified at time of analysis.
Packet buffer allocation failure in Juniper EX4000 and QFX5000 Series switches allows adjacent unauthenticated attackers to cause persistent Denial of Service requiring manual device restart. Attack vector requires specific configuration: device configured as service-provider edge with L2PT enabled on UNI and VSTP enabled on NNI in VXLAN scenarios. Receiving VSTP BPDUs on UNI triggers buffer exhaustion, halting all traffic forwarding. Affects Junos OS 24.4 through 24.4R1, 25.2 through 25.2R1. No public exploit identified at time of analysis.
Remote denial-of-service in Juniper Networks Junos OS (SRX/MX Series) allows unauthenticated attackers to crash IPsec daemons via malformed ISAKMP packets. Exploiting the improper input validation (CWE-1286) in kmd/iked IPsec library causes process restart, preventing new VPN security association establishment. Repeated attacks create sustained inability to establish VPN connections, severely degrading network connectivity for affected enterprise firewalls and routing platforms. No public exploit identified at time of analysis.
Juniper Networks CTP OS 9.2R1 and 9.2R2 fail to persist password complexity settings, enabling unauthenticated attackers to exploit predictable weak passwords on local accounts. The password management function allows administrators to configure complexity requirements but does not save these configurations, verifiable through 'Show password requirements' menu. This defect permits trivial passwords that attackers can brute-force remotely to gain full device control. No public exploit identified at time of analysis.
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Memory exhaustion in Juniper Networks Junos OS BroadBand Edge subscriber management daemon (bbe-smgd) on MX Series allows adjacent unauthenticated attackers to trigger persistent denial of service by sending authentication packets that do not match configured packet-type options. Each mismatched packet leaks memory, eventually consuming all available daemon heap memory and preventing new subscriber logins. Authentication packet-type configuration must be active for exploitation. No public exploit identified at time of analysis.
Memory leak in Juniper Networks Junos OS jdhcpd daemon enables adjacent unauthenticated attackers to crash DHCP services on MX Series routers. Each DHCPv6 subscriber logout in PPPoE or VLAN configurations with active/bulk lease query leaks memory, eventually exhausting resources and triggering jdhcpd crash. Service remains unavailable until process restart completes. Affects all Junos OS versions before 22.4R3-S1, 23.2 versions before 23.2R2, and 23.4 versions before 23.4R2. No public exploit identified at time of analysis.
Memory leak in Juniper Networks l2ald daemon allows adjacent attackers to crash Layer 2 services on EVPN-MPLS networks. Affects Junos OS and Junos OS Evolved across multiple versions. Unauthenticated attackers on the same network segment can trigger resource exhaustion by causing ESI route churn from multi-homed Provider Edge devices, forcing l2ald process crash and restart. No public exploit identified at time of analysis, but exploitation requires only network adjacency without authentication.
Symbolic link manipulation in Juniper Networks Junos OS CLI enables authenticated local attackers with low privileges to escalate to root access. Exploitation requires two users: the first performs a 'file link ...' CLI operation, then after the second user commits unrelated configuration changes, the first user can authenticate as root, achieving full system compromise. Affects Junos OS versions across 23.2, 23.4, 24.2, 24.4, and 25.2 release trains prior to specified patch levels. No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS Evolved on PTX Series routers allows authenticated users with low privileges to gain high-privileged direct access to Flexible PIC Concentrators (FPCs), enabling potential full compromise of affected line cards. Impacts PTX10004, PTX10008, PTX10016 with JNP10K-LC1201 or JNP10K-LC1202 line cards across multiple firmware branches. Missing authentication on critical FPC management functions permits unauthorized privilege elevation. No public exploit identified at time of analysis.
Management daemon deadlock in Juniper Networks Junos OS 23.4-24.4 and Junos OS Evolved enables network-based authenticated attackers to trigger complete management plane denial-of-service via rapid NETCONF session cycling. Vulnerability causes mgd processes to hang in lockf state, exhausting process pool and preventing administrative logins. Recovery requires device power-cycle. Affects deployments using NETCONF management interface with authenticated remote users. No public exploit identified at time of analysis.
Command injection in Juniper Networks Support Insights Virtual Lightweight Collector (JSI vLWC) CLI enables local high-privileged attackers to escalate privileges to root. Inadequate input validation in the CLI menu permits shell command injection, with injected commands executing at root level. All JSI vLWC versions before 3.0.94 affected. CVSS 8.4 (High severity, local vector). Requires high-level existing privileges (PR:H). No public exploit identified at time of analysis.
Local privilege escalation in Juniper Networks Junos OS and Junos OS Evolved allows low-privileged authenticated users to execute arbitrary code with root privileges. When unsigned Python operation scripts are enabled in device configuration, attackers can inject and execute malicious op scripts under root-equivalent context, achieving complete system compromise. Affects all Junos OS versions before 22.4R3-S7 and multiple branches through 24.4, plus corresponding Junos OS Evolved releases. No public exploit identified at time of analysis. CVSS 8.5 (High) with local attack vector requiring low privileges and no user interaction.
Incorrect permission assignment on critical resources in Juniper Networks On-Box Anomaly detection framework. Allows unauthorized modification of anomaly detection configuration, potentially disabling security monitoring.
Denial-of-service attacks against Juniper SRX Series devices running Junos OS 23.4 through 24.4 can be triggered remotely by sending a maliciously crafted DNS request, causing the flowd process to crash and interrupt service until recovery completes. The vulnerability stems from an unchecked return value in the DNS module that allows unauthenticated, network-based attackers to exploit DNS-enabled SRX configurations without any user interaction. No patch is currently available for affected versions.
Juniper Networks Junos OS on SRX and MX Series is vulnerable to a double free condition in the flow processing daemon that an unauthenticated network attacker can trigger via a specific TCP packet sequence, causing the daemon to crash and the Fabric Routing Card to restart. This denial-of-service vulnerability affects all versions before 22.4R3-S7, 23.2 before 23.2R2-S3, 23.4 before 23.4R2-S4, and 24.2 before 24.2R2, with no patch currently available. An attacker on the network can exploit this vulnerability without authentication or user interaction to disrupt service availability.
Malformed SSL packets can trigger a Denial-of-Service condition in Juniper SRX devices running Junos OS with UTM Web-Filtering enabled, causing Forwarding Processor Card (FPC) crashes and restarts without requiring authentication. An unauthenticated network-based attacker can exploit this input validation flaw in the Web-Filtering module to disrupt device availability across affected Junos versions (23.2R2-S2 through 24.4R2). No patches are currently available for earlier Junos versions, and affected systems remain vulnerable until updates are applied.
Juniper SRX Series devices are vulnerable to denial-of-service attacks when processing malformed GTP Modify Bearer Request messages, which trigger an improper lock condition that freezes packet processing threads and causes watchdog timeouts. An unauthenticated network attacker can exploit this without user interaction to crash the forwarding processor and cause complete traffic outages requiring device restart. No patch is currently available for affected Junos OS versions.
Unauthenticated network-based attackers can cause a denial of service on Juniper EX4000-48T, EX4000-48P, and EX4000-48MP switches by sending high-volume traffic that crashes the FXPC component and forces a device restart. The vulnerability stems from improper resource initialization in the Internal Device Manager and results in complete service outage until automatic recovery completes. Affected versions include Junos OS 24.4 before 24.4R2 and 25.2 before 25.2R1, with no patch currently available.
Juniper Junos OS and Junos OS Evolved contain a use-after-free vulnerability in the 802.1X authentication daemon that allows authenticated, network-adjacent attackers to crash the process or achieve arbitrary code execution as root by triggering specific port state changes. Exploitation requires precise timing of a change-of-authorization event during port transitions, making reliable exploitation difficult but possible. Systems with 802.1X port-based network access control enabled are affected, and no patch is currently available.